Gaussian Quantum Information 



Christian Weedbrook 

Center for Quantum Information and Quantum Control, Department of Electrical and Computer Engineering and 
Department of Physics, University of Toronto, Toronto, I\/I5S 3G4, Canada and 

Research Laboratory of Electronics, Massachusetts Institute of Technology Cambridge MA 02139, USA 
Stefano Pirandola 

Department of Computer Science, University of York, Deramore Lane, York YQ10 5GH, United Kingdom 
Raul Garcia-Patron 

Research Laboratory of Electronics, Massachusetts Institute of Technology Cambridge MA 02139, USA and 
Max-Pianck-lnstitut fur Quantenoptik, Hans-Kopfermann-Strasse 1, Garching, D-85748, Germany 

Nicolas J. Cerf 

Quantum Information and Communication, Ecole Polytechnlque, Unlverslte Libre de Bruxelies, 1050 Brussels, 
Belgium and 

Research Laboratory of Electronics, Massachusetts Institute of Technology Cambridge MA 02139, USA 
Timothy C. Ralph 

Centre for Quantum Computation and Communication Technology Department of Physics, University of Queensland, 
Brisbane, Queensland 4072, Australia 

Jeffrey H. Shapiro 

Research Laboratory of Electronics, Massachusetts Institute of Technology Cambridge MA 02139, USA 
Seth Lloyd 

Research Laboratory of Electronics, Massachusetts Institute of Technology Cambridge MA 02139, USA and 
Department of Mechanical Engineering, Massachusetts Institute of Technology Cambridge MA 02139, USA 

(Dated: October17, 2011) 

The science of quantum information has aiisen over the last two decades centered on the manipulation of indi- 
vidual quanta of information, known as quantum bits or qubits. Quantum computers, quantum cryptography and 
quantum teleportation are among the most celebrated ideas that have emerged from this new field. It was realized 
later on that using continuous-variable quantum information caiTiers, instead of qubits, constitutes an extremely 
poweiful alternative approach to quantum information processing. This review focuses on continuous-variable 
quantum information processes that rely on any combination of Gaussian states, Gaussian operations, and Gaus- 
sian measurements. Interestingly, such a restriction to the Gaussian realm comes with various benefits, since on 
the theoretical side, simple analytical tools are available and, on the experimental side, optical components ef- 
fecting Gaussian processes are readily available in the laboratory. Yet, Gaussian quantum information processing 
opens the way to a wide variety of tasks and applications, including quantum communication, quantum cryptog- 
raphy, quantum computation, quantum teleportation, and quantum state and channel discrimination. This review 
reports on the state of the art in this field, ranging from the basic theoretical tools and landmark experimental 
realizations to the most recent successful developments. 
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I. INTRODUCTION 

Quantum mechanics is the branch of physics that studies 
how the universe behaves at its smallest and most fundamental 
level. Quantum computers and quantum communication sys- 
tems transform and transmit information using systems such 
as atoms and photons whose behavior is intrinsically quan- 
tum mechanical. As the size of components of computers 
and the number of photons used to transmit information has 
pressed downwards to the quantum regime, the study of quan- 
tum information processing has potential practical relevance. 
Moreover, the strange and counterintuitive features of quan- 
tum mechanics translate into novel methods for information 
processing that have no classical analogue. Over the past two 
decades, a detailed theory of quantum information processing 
has developed, and prototype quantum computers and quan- 
tum communication systems have been constructed and tested 
experimentally. Simple quantum algorithms have been per- 
formed, and a wide variety of quantum communication proto- 
cols have been demonstrated, including quantum teleportation 
and quantum cryptography. 

Quantum information comes in two forms, discrete and 
continuous. The best-known example of discrete quantum 
information is the quantum bit or 'qubit', a quantum sys- 
tem with two distinguishable states. Examples of quan- 
tum systems that can be used to register a qubit are spin 
1/2 particles such as electrons and many nuclear spins, the 
two lowest energy states of semiconductor quantum dots or 
quantized superconducting circuits, and the two polariza- 
tion states of a single photon. Th e best-known example 
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Cerf et ai. 2QQli) is the quantized harmonic oscillator, which 
can be described by continuous variables such as position 
and momentum (an alternative description is the discrete but 
infinite-dimensional representation in terms of energy states). 
Examples of continuous-variable quantum systems include 
quantized modes of bosonic systems such as the different 
degrees of freedom of the electromagnetic field, vibrational 
modes of solids, atomic ensembles, nuclear spins in a quan- 
tum dot, Josephson junctions, and Bose-Einstein condensates. 
Because they supply the quantum description of the propagat- 
ing electromagnetic field, continuous-variable quantum sys- 
tems are particularly relevant for quantum communication 
and quantum-limited techniques for sensing, detection and 
imaging. Similarly, atomic or solid-state based encoding of 
continuous-variable systems can be used to perform quantum 
computation. Bosonic systems are not only useful in the phys- 
ical modeling of qubit-based quantum computation, e.g., the 
quantized vibrational modes of ions embody the medium of 
communication between qubits in ion-trap quantum comput- 
ers, but also allows for new approaches to quantum computa- 
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tion. 



A. Gaussian quantum information processing 

This review reports on the state of the art of quantum in- 
formation processing using continuous variables. The pri- 
mary tools for analyzing continuous-variable quantum infor- 
mation processing are Gaussian states and Gaussian transfor- 
mations. Gaussian states are continuous-variable states that 
have a representation in terms of Gaussian functions, and 
Gaussian transformations are those that take Gaussian states 
to Gaussian states. In addition to offering an easy description 
in terms of Gaussian functions, Gaussian states and transfor- 
mations are of great practical relevance. The ground state and 
thermal states of bosonic systems are Gaussian, as are states 
created from such states by linear amplification and loss. Fre- 
quently, nonlinear operations can be approximated to a high 
degree of accuracy by Gaussian transformations. For exam- 
ple, squeezing is a process that decreases the variance of one 
continuous variable (position or electric field, for example) 
while increasing the variance of the conjugate variable (mo- 
mentum or magnetic field). Linear squeezing is Gaussian, and 
nonlinear squeezing can typically be approximated to first or- 
der by a linear, Gaussian process. Moreover, any transforma- 
tion of a continuous-variable state can be built up by Gaussian 
processes together with a repeated application of a single non- 
linear process such as photodetection. 

In reviewing the basic facts of Gaussian qu antum 
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Ferraro et a/.Ll2005h and in reporting recent developments, we 
have attempted to present results in a way that is accessible 
to two communities. Members of the quantum optics and 
atomic physics communities are very familiar with the basic 
aspects of Gaussian quantum states and transformations, but 
may be less acquainted with the application of Gaussian 
techniques to quantum computation, quantum cryptography, 
and quantum communication. Members of the quantum 
information community are familiar with quantum informa- 
tion processing techniques such as quantum teleportation, 
quantum algorithms, and quantum error correction, but may 
have less experience in the continuous-variable versions of 
these protocols, which exhibit a range of features that do not 
arise in their discrete versions. 

The review is self-contained in the sense that study of the 
introductory material should suffice to follow the detailed 
derivations of more advanced methods of Gaussian quantum 
information processing presented in the body of the paper. Fi- 
nally, the review supplies a comprehensive set of references 
both to the foundations of the field of Gaussian quantum in- 
formation processing, and to recent developments. 



B. Outline of review 

The large subject matter and page length limit means that 
this review will take a mostly theoretical approach to Gaus- 



sian quantum information. In particular, we focus on optical 
Gaussian protocols as they are the natural choice of medium 
for a lot of the protocols presented in this review. How- 
ever, w e do make mention of G aussian atomic ensemble pro- 
tocols dHammerer et al. I I2OIOI) due to the close correspon- 
dence between continuous variables for light and atomic en- 
sembles. Furthermore, experiments (both optical and atomic) 
will be mentioned and cited where appropriate. We also note 
that fermionic Gauss ian stat e s have also been studied in the 
litera t ure (e.g., se e ( Bravvil 120051: iDi Vincenzo and TerhalL 
120051: lEisert' et al. 1 120101) ) but are outside the scope of this 
review. We limit our discussion of entanglement, quantum 
teleportation, quantum cloning, and quantum dense coding as 
these have all been discussed in detail previously, e.g., see 
IBraunstein and van Loockl(l2005h . On the other hand, we give 
a detailed account of bosonic quantum channels, continuous- 
variable quantum cryptography and quantum computation. 

We begin in Sec.|II]by introducing the fundamental theoret- 
ical concepts of Gaussian quantum information. This includes 
Gaussian states and their phase-space representations and 
symplectic structure, along with Gaussian unitaries, which are 
the simplest quantum operations transforming Gaussian states 
into Gaussian states. We then give examples of both Gaussian 
states and Gaussian unitaries. Multimode Gaussian states are 
discussed next using powerful techniques based on the manip- 
ulation of the second-order statistical moments. The quantum 
entanglement of bipartite Gaussian states is presented with the 
various measures associated with it. We end this section by 
introducing the basic models of measurement, such as homo- 
dyne detection, heterodyne detection and direct detection. 

In Sec.|III]we begin to go more deeply into Gaussian quan- 
tum information processing via the process of distinguishing 
between Gaussian states. We present general bounds and mea- 
sures of distinguishability, and discuss specific models for dis- 
criminating between optical coherent states. In Sec.|IV]we in- 
troduce basic Gaussian quantum information processing pro- 
tocols including quantum teleportation and quantum cloning. 

In Sec. |V] we review bosonic communication channels 
which is one of the fundamental areas of research in quan- 
tum information. Bosonic channels include communication 
by electromagnetic waves (e.g., radio waves, microwaves, and 
visible light), with Gaussian quantum channels being the most 
important example. These channels represent the standard 
model of noise in many quantum information protocols as 
well as being a good approximation to current optical telecom- 
munication schemes. We begin by first reviewing the gen- 
eral formalisms and chief properties of bosonic channels, and 
specifically, those of Gaussian channels. This naturally leads 
to the study of the important class of one-mode Gaussian 
channels. The established notions of Gaussian channel ca- 
pacity, both the classical and quantum versions, are presented 
next. Next up is entanglement-assisted classical capacity with 
quantum dense coding being a well-known example. This is 
followed by the concepts of entanglement distribution over 
noisy Gaussian channels and secret-key capacities. Finally, 
we end with the discrimination of quantum channels and the 
protocols of quantum illumination and quantum reading. 

The state of the art in the burgeoning field of continuous- 



variable quantum cryptography is presented in Sec. |Vl] We 
begin by introducing how a generic quantum cryptographic 
scheme works followed by examples of the most commonly 
studied protocols. We then consider aspects of their security 
including what it means to be secure along with the main types 
of eavesdropping attacks. We continue with the practical sit- 
uation of finite-size keys and the optimality and full charac- 
terization of collective Gaussian attacks before deriving the 
secret-key rates for the aforementioned protocols. We con- 
clude with a discussion on the future avenues of research in 
continuous-variable quantum cryptography. 

In Sec. IVllI we review the most recent of the continuous- 
variable quantum information protocols, namely, quantum 
computation using continuous-variable cluster states. We be- 
gin by listing the most commonly used continuous-variable 
gates and by discussing the Lloyd-Braunstein criterion which 
provides the necessary and sufficient conditions for gates to 
form a universal set. The basic idea of one-way quantum 
computation using continuous variables is discussed next with 
teleportation providing an elegant way of understanding how 
computations can be achieved using only measurements. A 
common and convenient way of describing cluster states, via 
graph states and the nullifier formalism, is presented. Next, 
we consider the practical situations of Gaussian computa- 
tional errors along with the various optical implementations of 
Gaussian cluster states. This leads into a discussion on how to 
incorporate universal quantum computation and quantum er- 
ror correction into the framework of continuous-variable clus- 
ter state quantum computation. We end by introducing two 
quantum computational algorithms and provide directions for 
future research. In Sec. IVIIII we offer perspectives and con- 
cluding remarks. 



C. Further readings 
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views of IScarani et al. \ ( l2009l) and lCerf and Grangieil ( l2007l) . 
Cluster state quantum computa tion using continuous vari- 
ables is treated in the books o f iKok and LovettI (|2010|) and 
iFurusawa and van Loockl (1201 Ih . 



D. Comment on notation 

Throughout this review, the variance of the vacuum noise 
is normalized to 1. Such a normalization is commonly and 
conveniently thought of as setting Planck's constant ft to a 
particular value, in our case h = 2. Currently, in continuous- 
variable quantum information there is no general consensus 
about the value of the variance of the vacuum, with common 
choices being either 1/4 (ft = 1/2), 1/2 (ft = 1) or 1. This 
is important to point out to the reader who, when referring to 
the many references in this review, should be aware that dif- 
ferent papers use different choices of normalization. Another 
nomenclature issue in the literature is the notation used to de- 
fine the quadrature operators (and the corresponding eigen- 
values). Here we define the 'position' quadrature by q and the 
'momentum' quadrature by p. In this review, the logarithm 
(log) can be taken to be base 2 for bits or In for nats. I repre- 
sents the identity matrix which may be 2 x 2 (for one mode) or 
2N X 2N (for arbitrary N modes). The correct dimensions, if 
not specified, can be deducted from the context. Since we deal 
with continuous variables, we can have both discrete and con- 
tinuous ensembles of states, measurement operators, etcetera. 
In order to keep the notation as simple as possible, in some 
parts we consider discrete ensembles. It is understood that the 
extension to continuous ensembles involves the replacement 
of sums by integrals. Finally, integrals are taken from — oo to 
+00 unless otherwise stated. 



For additional readings, perhaps the first place to start for 
an overview of continuous-variab le quantum information is 
the we ll-known review article by IBraunstein and van Loockl 
(120051). Furth e rmore, there is also the recent review by 



lAndersen et al. 1 (l2010h as well as two edited books on 
the su bject by IBraunstein and PatH ( I2b03i) and ICerf et a/1 
(I2OO7I) . On Gaussian quant um informa ti on sp ecifically 
there is the revie w article by IWang et al.\ (l2007l) and the 
lecture notes of Ferraro ef a/.l ( 20051). For a q u anturn 
optics dBachor and Ralph! 12004 lOerrv and Knightl 120051: 
iLeonhardtl I2OIOI) approach to qu a ntum i nformation see 
the textboo ks bv IWalls and MilburnI (l2008b . iKok and LovettI 
(I2OIOI) and! urusawa and van Loockl (|201 lb (who provide a 
joint theoretical and experimental point of view). Whilst, 
the current state of the art of continuous variables using 
atomic ensemble s can be found in the review article of 
[Hammerer et a i] (I2010I) . For a detailed treatment of Gaus- 
sian systems see the textbook bv lHolevol(l201 lb . An overview 
of Gaussian ent a nglem ent is presented in the review of 
lEisert and Pleniol (l2003b . For a n elementary introducti on to 
Gaussian quantum channels, see lEisert and Woli) ( l2007b . and 
for continuous-variable quantum cryptography, see the re- 



II. ELEMENTS OF GAUSSIAN QUANTUM INFORMATION 
THEORY 

A. Bosonic systems in a nutsPiell 

A quantum system is called a continuous-variable system 
when it has an infinite-dimensional Hilbert space described 
by observables with continuous eigenspectra. The prototype 
of a continuous-variable system is represented by N bosonic 
modes, corresponding to N quantized radiation modes of the 
electromagnetic field, i.e., N quantum harmonic oscillators. 
In general, N bosonic modes are associated with a tensor- 
product Hilbert space 7^®^ = and correspond- 
ing N pairs of bosonic field operators {afc,ajj}j^i, which 
are called the annihilation and creation operators, respec- 
tively. These operators can be arranged in a vectorial operator 
b :— (ai, a| , • • • , cat, ajy)^, which must satisfy the bosonic 
commutation relations 



= , (i,j = l,-- - ,27V) 



(1) 
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where flij is the generic element of the 2N x 27V matrix 



TV 



n := 0a; = 



u! := 



k=l 



1 

-1 



(2) 



known as the symplectic form. The Hilbert space of this sys- 
tem is separable and infinite-dimensional. This is because the 
single-mode Hilbert space H is spanned by a countable ba- 
sis {|?T.)}5^Q, called the Fock or number state basis, which is 
composed by the eigenstates of the number operator n := a^a, 
i.e., h\n) = n \n). Over these states the action of the bosonic 
operators is well-defined, being determined by the bosonic 
commutation relations. In particular, we have 



,|0) =0, 



and 



1 



1) (for n > 1), (3) 



1) (for?i>0). (4) 



Besides the bosonic field operators, the bosonic system may 
be described by another kind of field operators. These are the 
quadrature field operators {qk,Pk}k=i^ formally arranged in 
the vector 



(5) 



These operators derive from the cartesian decomposition of 
the bosonic field operators, i.e., Ofc := ^{qk + ipk) or equiva- 
lently. 



qk 



ak + a[, Pk := i{a{ 



Clk)- 



(6) 



The quadrature field operators represent dimensionless canon- 
ical observables of the system and act like the position and 
momentum operators of the quantum harmonic oscillator In 
fact, they satisfy the canonical commutation relations in natu- 
ral units (ft = 2) 



2in, 



(7) 



which are easily derivable from the bosonic commutator rela- 
tions of Eq. ([T]). In the following, we will use both kinds of 
field operators, the bosonic field operators and the quadrature 
field operators. 

Now it is important to note that the quadrature operators 
are observables with continuous eigenspectra. In fact the two 
quadrature operators q (position) and p (momentum) have 
eigenstates' 



q\q) =q\q) , p\p) =pb> 



(8) 



' Strictly speaking, \q) and \p) are improper eigenstates since they are non- 
normalizable, tlius lying outside the Hilbert space. Correspondingly, q and 
p are improper eigenvalues. In the remainder we take this mathematical 
subtlety for granted. 



with continuous eigenvalues q G M and p G M. The two 
eigensets {|9)}qeR {|p)}peR identify two bases which are 
connected by a Fourier transform 



\q) 



1 



2V^ 



dpe-*«P/2 |p) , \p) 



dqe"^P/^ \q) 



In general, for the A^-mode Hilbert space we can write 



Ix) 



(9) 



(10) 



with X G R^^ and |x) := , . . . , \x2n}) ■ Here the 

quadrature eigenvalues x can be used as continuous variables 
to describe the entire bosonic system. This is possible by in- 
troducing the notion of phase-space representation. 



1 . Phase-space representation and Gaussian states 

All the physical information about the N-mode bosonic 
system is contained in its quantum state. This is represented 
by a density operator p, which is a trace-one positive operator 
acting on the corresponding Hilbert space, i.e., p : "H"^^ —j, 
n®^. We denote by V{'H®^) the space of the density oper- 
ators, also called the state space. Whenever p is a projector 
{p^ = p) we say that p is pure and the state can be represented 
as /5 = \if) where \if) G Ti.®^ . Now it is important to 
note that any density operator has an equivalent representation 
in terms of a quasi-probability distribution (Wigner function) 
defined over a real symplectic space (phase space). In fact, let 
us introduce the Weyl operator 



(11) 



where ^ G . Then, an arbitrary p is equivalent to a Wigner 
characteristic function 



x(0=Tr[pi?(0], 
and, via Fourier transform, to a Wigner function 



(12) 



W{y.) 



K2« 



(2^) 



2N 



exp -ix^ m x(|), (13) 



which is normalized to one but generally non-positive (quasi- 
probability distribution). In Eq. ( fT3] l the continuous variables 
are the eigenvalues of quadratures operators x. 



X G 



p2JV 



These variables span a real symplectic space K, := (R^^, il) 
which is called the phase space. Thus, an arbitrary quantum 
state p of a iV-mode bosonic system is equivalent to a Wigner 
function VF(x) defined over a 2A^-dimensional phase space 
K. 

The most relevant quantities that characterize the Wigner 
representations (x or W) are the statistical moments of the 
quantum state. In particular, the first moment is called the 
displacement vector or, simply, the mean value 



Tr(xp), 



(14) 
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and the second moment is called the covariance matrix V, 
whose arbitrary element is defined by 



(15) 



where Axi := Xi — {xi) and {, } is the anti-commutator. In 
particular, the diagonal elements of the covariance matrix pro- 
vide the variances of the quadrature operators, i.e., 



(16) 

^. The covariance 



where V{xi) - ((Ax,)2) - - 
matrix is a 2N x 2N, real and s ymmetric matrix wh ich must 
satisfy the uncertainty principle ( Simon et a/.ll 19941) 



V + ir2 > 0, 



(17) 



directly coming from the commutation relations of Eq. (|7]i, 
and implying the positive definiteness V > 0. From the diag- 
onal terms in Eq. ( [TtI i. one can easily derive the usual Heisen- 
berg relation for position and momentum 



V{qu)V{pk) > 1. 



(18) 



For a particular class of states the first two moments are 
sufficient for a complete characterization, i.e., we c an write 
p — p(x, V ). This is the case of the Gaussian states dHolevol 
1 19751 1201 1[) . By definition, these are bosonic states whose 
Wigner representation (x or W) is Gaussian, i.e.. 



x(0 

W{x) 



cxp 



exp [-i(x - x)^V-Hx - x) 
(27r)^VditV 



(19) 
(20) 



It is interesting to note that a pure state is Gaussian, if and 
only if, its Wigner function is non-neg ative dHudsoni [l97i 
iMandilara ef"ani2009HSoto et all\l9S3 . 



2. Gaussian unitaries 

Since Gaussian states are easy to characterize, it turns 
out that a large class of transformations acting on these 
states are easy to describe too. In general, a quantum 
state undergoes a transformatio n called a quantum opera- 
tion jNielsen and ChuanS, l2000l) . This is a linear map £ : 
p — > £{p) which is completely positive and trace-decreasing, 
i.e., < Tr[£(p)] < 1. A quantum operation is then 
called a quantum channel when it is trace-preserving, i.e., 
Tr [£{p)] = 1. The simplest quantum channels are the ones 
which are reversible. These are represented by unitary trans- 
formations U^^ = W, which transform a state according to 
the rule p — > UpU^ or, simply, \ip) — > U\ip), if the state is 
pure. 

Now we say that a quantum operation is Gaussian when 
it transforms Gaussian states into Gaussian states. Clearly, 
this definition applies to the specific cases of quantum chan- 
nels and unitary transformations. Thus, Gaussian channels 
(unitaries) are those channels which preserve the Gaussian 



character of a quantum state. Gaussian unitaries are gener- 
ated via U = exp{—iH/2) from Hamiltonians H which are 
second-order polynomials in the field operators. In terms of 
the annihilation and creation operators a := (ai, • • • , aN)"^ 
and a^^ := (a|, • • • , ajy) this means that 



H = iia'a: + a'Fa + a^Ga^^) + h.c 



(21) 



where a e and F, G are N x N complex matrices and 
h.c. stands for 'Hermitian conjugate'. In the Heisenberg pic- 
ture, this kind of unitary corresponds to a linear unitary Bo- 
goliubov transformation 



a U^'aU = Aa + Ba 



cx 



(22) 



where the N x N complex matrices A and B satisfy AB"^ = 
BA^ and AA^ = BB^ + I with I being the identity matrix. 
In terms of the quadrature operators, a Gaussian unitary is 
more simply described by an affine map 



(S,d) 



Sx + d, 



(23) 



where d € and S is a 2N x 2N real matrix. This trans- 
formation must preserve the commutation relations of Eq. Q, 
which happens when the matrix S is symplectic, i.e.. 



sns' 



n 



(24) 



Clearly the eigenvalues x of the quadrature operators x must 
follow the same rule, i.e., (S, d) : x Sx + d. Thus, an 
arbitrary Gaussian unitary is equivalent to an affine symplec- 
tic map (S, d) acting on the phase space, and can be denoted 
by ^^s.d- In particular, we can always write Us,d ~ D{d)Us, 
where the canonical unitary Us corresponds to a linear sym- 
plectic map X — > Sx, and the Weyl operator D{d) to a phase- 
space translation x ^> x + d. Finally, in terms of the statisti- 
cal moments, x and V, the action of a Gaussian unitary Us,d 
is characterized by the following transformations 



X ^ Sx + d , V 



svs' 



(25) 



Thus the action of a Gaussian unitary Us,d over a Gaussian 
state p(x, V) is completely characterized by Eq. ( l25l l. 



B. Examples of Gaussian states and Gaussian unitaries 

Here we introduce some elementary Gaussian states that 
play a major role in continuous-variable quantum informa- 
tion. We also introduce the simplest and most common Gaus- 
sian unitaries and discuss their connection with basic Gaus- 
sian states. In these examples we first consider one and then 
two bosonic modes with the general case (arbitrary N) dis- 
cussed in Sec. III. CI 



1 . Vacuum states and thermal states 

The most important Gaussian state is the one with zero pho- 
tons (n = 0), i.e., the vacuum state |0). This is also the 
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eigenstate with zero eigenvalue of the annihilation operator 
(a |0) = 0). The covariance matrix of the vacuum is just the 
identity, which means that position and momentum operators 
have noise-variances equal to one, i.e., V{q) = V{p) ~ 1. 
According to Eq. ( fTSl l, this is the minimum variance which 
is reachable symmetrically by position and momentum. It is 
also known as vacuum noise or quantum shot-noise. 

As we will soon see, every Gaussian state can be decom- 
posed into thermal states. From this point of view, a ther- 
mal state can be thought of as the most fundamental Gaussian 
state. By definition, we call thermal a bosonic state which 
maximizes the von Neumann entropy 

5:=-Tr(plnp), (26) 

for fixed energy Tr(pa^d) = n, where n > is the mean 
number of photons in the bosonic mode. Explicitly, its 
number-state representation is given by 

^*'(") = E (^+V^ N H . (27) 

n— ^ ^ 

One can easily check that its Wigner function is Gaussian, 
with zero mean and covariance matrix V = (2n +1)1 where 
I is the 2x2 identity matrix. 

2. Displacement and coherent states 

The first Gaussian unitary we introduce is the displacement 
operator, which is just the complex version of the Weyl opera- 
tor. The displacement operator is generated by a linear Hamil- 
tonian and is defined by 

D{a) := exp(aa^ — a* a) , (28) 

where a = {q + ip)/2 is the complex amplitude. In the 
Heisenberg picture, the annihilation operator is transformed 
by the linear unitary Bogoliubov transformation a ^ a + a, 
and the quadrature operators x ~ {q,p)^ by the translation 
X ^ X + da, where = {q,p)'^ . By displacing the vacuum 
state, we generate coherent states \a) = D{a) |0). They have 
the same covariance matrix of the vacuum (V = I) but dif- 
ferent mean values (x = d^). Coherent states are the eigen- 
states of the annihilation operator a\a) ~ a \a) and can be 
expanded in number states as 

|a)=exp(-i|ap)5]^|n) . (29) 

n=0 

Furthermore, they form an overcomplete basis, since they are 
non-orthogonal. In fact, given two coherent states |a) and |/3), 
the modulus squared of their overlap is given by 

|(/?|a)|2 = cxp(-|/?-an. (30) 

3. One-mode squeezing and squeezed states 

When we pump a nonlinear crystal with a bright laser, some 
of the pump photons with frequency 2oj are split into pairs 



of photons with frequency lo. Whenever the matching condi- 
tions for a degenerate optical para metric amplifier (OPA) are 
satisfied dWalls and Milburnll2008l) . the outgoing mode is ide- 
ally composed of a superposition of even number states ( 1 2n) ). 
The interaction Hamiltonian must then contain a a^^ term to 
generate pairs of photons and a term to ensure hermiticity. 
The corresponding Gaussian unitary is the one-mode squeez- 
ing operator, which is defined as 

S'(r) ;=cxp[r(a2_at2)/2] , (31) 

where r e M is called the squeezing parameter. In the Heisen- 
berg picture, the annihilation operator is transformed by the 
linear unitary Bogoliubov transformation a (cosli r)a — 
(sinh r)at and the quadrature operators x ~ {q,p)'^ by the 
symplectic map x S(r)x, where 

S(,-) := ( ) . (32) 

Applying the squeezing operator to t he vacuum we generate a 
squeezed vacuum state (lYuenl[r976l) . 

|0, r) ^ -jl= tanhr" |2n) . (33) 

Vcoshr;^ 2"n! 

Its covariance matrix is given by V = S(r)S(r)'^ = S(2r) 
which has different quadrature noise-variances, i.e., one vari- 
ance is squeezed below the quantum shot-noise, whilst the 
other is anti-squeezed above it. 

4. Pliase rotation 

The phase is a crucial element of the wave behavior of the 
electromagnetic field with no physical meaning for a single 
mode on its own. In continuous-variable systems the phase is 
usually defined with respect to a local oscillator, i.e., a mode- 
matched classical beam. Applying a phase shift on a given 
mode is done by increasing the optical path length of the beam 
compared to the local oscillator. For instance, this can be 
done by adding a transparent material of a tailored depth and 
with a higher refractive index than vacuum. The phase rota- 
tion operator is generated by the free propagation Hamiltonian 
H = 29a^a, so that it is defined by R{0) = cxp{—i9a^a). In 
the Heisenberg picture, it corresponds to the simple linear uni- 
tary Bogoliubov transformation a — > e*^a for the annihilation 
operator. Correspondingly, the quadratures are transformed 
via the symplectic map x R(6')x, where 

Ri9):^( ''''D , (34) 

^ ' y — sill cos J 

is a proper rotation with angle 9. 

5. General one-mode Gaussian states 

Using the singular value decomposition, one can show 
that any 2x2 symplectic matrix can be decomposed as 
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S = R(0)S(r)R((/i). This means that any one-mode Gaus- 
sian unitary can be expressed as D{d)Us where Us = 
R{6)S{r)R{(j)). By applying this unitary to a thermal state 
Pth{n), the result is a Gaussian state with mean d and co vari- 
ance matrix 



V = (2n + l)R(6')S(2r)R(6l)'^ 



(35) 



This is the most general one-mode Gaussian state. This re- 
sult can be generalized to arbitrary N bosonic modes as we 
will see in Sec. III.Cl Now, by setting n = in Eq. (l35l l. we 
achieve the covariance matrix of the most general one-mode 
pure Gaussian state. This corresponds to a rotated and dis- 
placed squeezed state |a, 9, r) = D{a)R(9)S(r) |0). 



6. Beam splitter 

In the case of two bosonic modes one of the most important 
Gaussian unitaries is the beam splitter transformation, which 
is the simplest example of an interferometer This transforma- 
tion is defined by 



B{0) = cxp[0(a^& - ah^)] 



(36) 



where a and 6 are the annihilation operators of the two modes, 
and 9 which determines the transmissivity of the beam splitter 
r = cos^6' G [0, 1]. The beam splitter is called balanced 
when T = 1/2. In the Heisenberg picture, the annihilation 
operators are transformed via the linear unitary Bogoliubov 
transformation 



(37) 



and the quadrature operators x := {<ia,PaAb,Pb)^ are trans- 
formed via the symplectic map 



x^B(t)x, B(t) := 



(38) 



7. Two-mode squeezing and EPR states 

Pumping a nonlinear crystal in the non-degenerate OPA 
regime, we generate pairs of photons in two different modes, 
known as the signal and the idler. This process is described by 
an interaction Hamiltonian which contains the bilinear term 
a^fo^. The corresponding Gaussian unitary is known as the 
two-mode squeezing operator and is defined as 



S2{r) ^ cxp r{ab~aTb^)/2 



(39) 



where r quantifies the two-mode squeezing 

(iBraunstein and van Loockl l2005h . In the Heisenberg 

picture, the quadratures x := {qa,Pa,<ib,'Pb)'^ undergo the 
symplectic map 



x^S2(r)x, S2(r) 



coshr I sinhr Z 
sinhr Z coshr I 



(40) 



where I is the identity matrix and Z : = diag(l,— 1). By 
applying 5*2 (r) to a couple of vacua, we obtain the two-mode 
squeezed vacuum state, also known as an Einstein-Podolski- 
Rosen (EPR) state p^P^{r) = |r) {r\^p^, where 



' epr 



= yT^^(-A)"|n)Jn), , (41) 



where A = tanlir e [0, 1]. This is a Gaussian state with zero 
mean and covariance matrix 



^ epr 



where v 



\A^2— iz 



^^2— 



■=Y,pr{.v), (42) 



cosh2r quantifies the noise-variance in the quan- 
dratures (afterwards, we also use the notation \v) ^j^^). Using 
Eq. ( l42b one can easily check that 

V{q-) = V{p+) = e-^- , (43) 



where g_ := {qa - qb)/V2 and p+ := {pa +pb)/V2. Note 
that for r = 0, the EPR state corresponds to two vacua and 
the previous variances are equal to 1, corresponding to the 
quantum shot-noise. For every two-mode squeezing r > 0, 
we have V{q-) = < 1, meaning that the correlations 

between the quadratures of the two systems beat the quantum 
shot-noise. These correlations are known as EPR correlations 
and they imply the presence of bipartite entanglement. In the 
limit of r — > oo we have an ideal EPR state with perfect cor- 
relations: Qa = qb and pa = —pb- Clearly, EPR correlations 
can also exist in the symmetric case for q+ and p- using the 
replacement Z — Z in Eq. ( |42] |. 

The EPR state is the most commonly used Gaussian en- 
tangled state and has maximally-entangled quadratures, given 
its average photon number. Besides the use of a non- 
degenerate parametric amplifier, an alternative way to gener- 
ate the EPR state is by combining two appropriately rotated 
squeezed vacuum states (o utputs of two degenerate OPAs) 
on a balanced b e am sp litter jBraunstein and van Loockll2005 



iFurusawa et al 1 Il998l) . This passive generatio n of entan- 
gleme nt from squeezing has been generalized by IWolf et al\ 
(l2003h . When one considers Gaussian atomic processing, the 
same state can also be created using two atom ic (macroscopic) 
objects as shown by lJulsgaard et al. \ (1200 ll) . Finally, let us 
note the important relation between the EPR state and the 
thermal state. By tracing out one of the two modes of the 
EPR state, e.g., mode h, we get Trh[/5'^'"'(r)] = p*-J^{n), where 
n = sinh^r. Thus, the surviving mode is described by a ther- 
mal state, whose mean photon number is related to the two- 
mode squeezing. Because of this, we also say that the EPR 
state is the purification of the thermal state. 



C. Symplectic analysis for multimode Gaussian States 

In this section we discuss the most powerful approach to 
studying Gaussian states of multimode bosonic systems. This 
is based on the analysis and manipulation of the second-order 
statistical moments, and its central tools are Williamson's the- 
orem and the Euler decomposition. 
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1 . Thermal decomposition of Gaussian states 

According to Williamson's theorem, every positive-definite 
real matrix of even dimensio n can be put in diag onal form by 
a symplectic transformation dWilliamsonl Il936i) . In particu- 
lar, this theorem can be applied to covariance matrices. Given 
an arbitrary iV-mode covariance matrix V, there exists a sym- 
plectic matrix S such that 



JV 



V = SV®S , 



(44) 



very simpl e formula for the pu r ificati on of an arbitrary Gaus- 
sian state dHolevo and Werneil I2OO1I) . In fact, let us denote 
by A a system of N modes described by a Gaussian state 
/5a(x, V), and introduce an additional reference system R of 
modes. Then, we have p a (x, V) = Trfl[/5Afl(x', V')], 
where par is a pure Gaussian state for the composite system 
AR, having mean x' = (x, 0)"^ and covariance matrix 



v 



V sc 



TV 

e 

k=l 



- IZ 



(50) 



k=l 



where the diagonal matrix V® is called the Williamson form 
of V, and the N positive quantities i^k are called the symplec- 
tic eigenvalues of V. Here the symplectic spectrum {j^fcj^i 
can be easily computed as the standard eigenspectrum of the 
matrix |ir2V|, where the modulus must be understood in the 
operatorial sense. In fact, the matrix iOV is Hermitian and 
is therefore diagonalizable by a unitary transformation. Then, 
by taking the modulus of its 2N real eigenvalues, one gets the 
N symplectic eigenvalues of V. The symplectic spectrum is 
very important since it provides powerful ways to express the 
fundamental properties of the corresponding quantum state. 
For example, the uncertainty principle of Eq. (fTTI i is equiva- 
lent to 



V > 0, V® > I . 



(45) 



In other words, a quantum covariance matrix must be positive 
definite and its symplectic eignevalues must satisfy i^k > 1. 
Then, the von Ne umann entropy S(p ) of a Gaussian state p 
can be written as dHolevo ef aail999h 



N 



(46) 



k=l 



where 



(47) 

In the space of density operators, the symplectic decomposi- 
tion of Eq. d44] i corresponds to a thermal decomposition for 
Gaussian states. In fact, let us consider a zero-mean Gaussian 
state p(0, V). Because of Eq. d44b . there exists a canonical 
unitary Us such that p(0, V) = C/s/5(0, V®)[/^, where 



p(0,V9 



JV 



fe=i 



(48) 



2. Euler decomposition of canonical unitaries 

The canonical unitary Us in Eq. d49] l ca n be suitably 
decomposed using the Euler decomposition dArvind et ali 
I1995I). alternatively kn own as the Bloch-Messiah reduc- 
tion dBraunsteinl |2005|) . First of all, let us distinguish be- 
tween active and passive canonical unitaries. By definition, 
a canonical unitary Us is called passive (active) if it is pho- 
ton number preserving (non-preserving). A passive Us cor- 
responds to a symplectic matrix S which preserves the trace 
of the covariance matrix, i.e., Tr(SVS"'") = Tr(V) for any 
V. This happens when the symplectic matrix S is orthogo- 
nal, i.e., S-^= S^^. Passive canonical unitaries describe mul- 
tiport interferometers, e.g., the beam splitter in the case of two 
modes. By contrast, active canonical unitaries correspond to 
symplectic matrices which are not trace-preserving and, there- 
fore, cannot be orthogonal. This is the case of the one-mode 
squeezing matrix of Eq. d32] ). Arbitrary symplectic matrices 
contain both the previous elements. In fact, every symplectic 
matrix S can be written as 



K 



N 



0S(r,) 



,fe=i 



(51) 



where K, L are symplectic and orthogonal, while S(ri), • • • , 
S(rAr) is a set of one-mode squeezing matrices. Direct sums 
in phase space correspond to tensor products in the state space. 
As a result, every canonical unitary Us can be decomposed as 



Us^U 



K 



JV 



.k=l 



(52) 



i.e., a multiport interferometer (J7l), followed by a parallel 
set of N one-mode squeezers {^kS{rk)), followed by another 
passive transformation (C/k)- Combining the thermal decom- 
position of Eq. d49] l with the Euler decomposition of Eq. d52l ). 
we see that an arbitrary multimode Gaussian state p{x, V) can 
be realized by preparing N thermal states p{0, V®), applying 
multimode interferometers and one-mode squeezers accord- 
ing to Eq. d52b . and finally displacing them by x. 



is a tensor-product of one-mode thermal states whose pho- 
ton numbers are provided by the symplectic spectrum {z^^} of 
the original state. In general, for an arbitrary Gaussian state 
/5(x, V) we can write the thermal decomposition 

/5(x, V) = D{x)Us [/5(0, V®)] ulDix^ . (49) 3- Two-mode Gaussian states 



Using the thermal decomposition of Eq. d49] ) and the fact 
that thermal states are purified by EPR states, we can derive a 



Gaussian states of two bosonic modes (A^ = 2) represent a 
remarkable case. They are characterized by simple analytical 
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formulas and represent the simplest states for studying proper- 
ties like quantum entanglement. Given a two-mode Gaussian 
state p(x, V), let us write its covariance matrix in the block 
form 



V = 



A C 
B 



(53) 



where A = A-'^, B = B^ and C are 2 x 2 real matrices. 
Then, the Williamson form is simply V® = (i^^I) ® (^^+1), 
where symplectic spectrum , zy+} is provided by 



'A± VA2 -4dctV 



(54) 



the 



with A := dct A + dc t B + 2detC and dot is 
determinant dSerafini et al. I 12004 . In this case the un 
certainty prin ciple is equivalent to the bona-fid e condi 
tions CPirandol a. Serafini. and Llovdll2009HSerafinil 12006) 



V > 0, dct V > 1 and A < 1 + dct V. 



(55) 



An important class of two-mode Gaussian sta t es has covari- 
ance matrix in the standard form dPuan et al. 1 12005 Is unonl 
I2OOOI) 



V 



f al C\ 


, c = 






[c bl 







C2 / 



(56) 



where a, 6, Ci, C2 G M must satisfy the previous bona-fide con- 
ditions. In particular, for ci = — C2 :— c > 0, the symplec- 
tic eigenvalues are simply iy± = [y/y ± {b — a)]/2, where 
y := {a + b)^ — Ac^. In this case, we can also derive the ma- 
trix S realizing the symplectic decomposition V = SV®S^. 
This is given by the formula 



S = 



2Vy 



(57) 



classical communications (LOCCs). By definition, a state is 
called entangled when it is not separable, i.e., the correlations 
between A and B are so strong that they cannot be created by 
any strategy based on LOCCs. In entanglement theory there 
are two central questions to answer: "Is the state entangled?", 
and if the answer is yes, then "how much entanglement does it 
have?". In what follows we review how we can answer those 
two questions for Gaussian states. 



1. Separability 



As first shown bv lHorodecki et al.\ ( 1 19961) and lPeresI ( Il996h . 
a key-tool for studying separability is the partial transposition, 
i.e., the transposition with respect to one of the two subsys- 
tems, e.g., system B. In fact, if a quantum state p is separable, 
then its partial transpose is a valid density operator and 
in particular positive, i.e., /5^^ > 0. Thus, the positivity of 
the partial transpose represents a necessary condition for sep- 
arability. On the other hand, the non-positivity of the partial 
transpose represents a sufficient condition for entanglement. 
Note that, in general, the positivity of the partial transpose 
is not a sufficient condition for separability, since there exist 
entangled states with positive partial transpose. These states 
are bound entangled meaning that their ent anglement cannot 
be distilled into maximally entangled states jHorodecki et ali 
IT998,..2009.) . 

The partial transposition operation corresponds to a local 
time reversal jHorodecki et all Il998l) . For bosonic systems 
the quadratures x of the bipartite system A + B undergo the 
transformation x — > {Ia ffi Ts)x, wh ere 1 4 is the A^-mode 
identity matrix while Tb := ©feiiZ ( ISimonll2000h . Let us 
consider an arbitrary Gaussian state p(x, V) of the bipartite 
system A + B, also known as an x M bipartite Gaussian 
state. Under the partial transposition operation, its covariance 
matrix is transformed via the congruence 



V ^ (Ia ® Tb)V(Ia e Tb) := V 



(59) 



D. Entanglement in bipartite Gaussian states 

Entanglement is one of the most important properties of 
quantum mechanics, being central in most quantum informa- 
tion protocols. To begin with let us consider two bosonic sys- 
tems, A with N modes and B with Al modes, having Hilbert 
spaces Ha and Hb, respectively. The global bipartite system 
A + B has a Hilbert space H = Ha ®T-Lb- By definition, a 
quantum state p G P('H) is said to be separable if it can be 
written as convex combination of product states, i.e.. 



/5 = ^P./5f ®/5f, 



e ViUAiB)), (58) 



where Pi > i) and X^iP* = 1- Note that the index can also 
be continuous. In such a case, the previous sum becomes 
an integral and the probabilities are replaced by a probabil- 
ity density function. Physically, Eq. ( |58l ) means that a separa- 
ble state can be prepared via local (quantum) operations and 



where the partially-transposed matrix V is positive definite. If 
the state is separable, then V satisfies the uncertainty princi- 
ple, i.e., V + iJl > 0. Since V > 0, this is equivalent to check 
the condition V® > I, where V® is the Williamson form of 
V. This is also equivalent to check i>_ > 1, where i>_ is the 
minimum eigenvalue in the symplectic spectrum {vk] of V. 

The satisfaction (violation) of the condition i>_ > 1 cor- 
responds to having the positivity (non-positivity) of the par- 
tially transposed Gaussian state. In some restricted situations, 
this positivity is equivale nt to separability. This happens for 
1 X M Gaussian states dWerner and Wolfl 1200 ll) . and for a 
particular cla ss of TV x M Gaussian states which a re called 
bisymmetric dSerafini. Adesso. and Illuminatill2005l) . In gen- 
eral, the equivale nce is not true, as shown already for 2x2 
Gaussian states bv lWerner and WoU (1200 ll) . Finally, note that 
the par tial transposition i s not the only way to study separabil- 
ity. In jPuan ef a/.ll2000l) the authors constructed an insepara- 
bility criterion, generalizing the EPR correlations, which gives 
a sufficient condition for entanglement (also necessary for 1x1 
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Gaussian states). Two other useful techniques exist to fully 
characterize the separability of bipartite Gaussian states. The 
first u ses nonlinear maps as shown by iGiedke. Kraus. et all 
(l200lb . where the secon d reduces the se parability problem to 
a semi-definite program dHvUus and Eisertt,,2006D . 



2. Entanglement measures 

In the case of pure N x M Gaussian states \ip), the entan- 
glement is provided by the entropy of entanglement Ev{\<p))- 
This is defined as the von Neumann entropy of the reduced 
states P A.B ^ TrB.Ad'fi) i'Pl), i . e., Ey (\Lp)) = S{pa) = 
S{pb) ( Bennett. Bernstein, et ail [l996l) . which can be eas- 
ily calcuated using Eq. ( |46] l. The entropy of entanglement 
gives the amount of entangled qubits (measured in e-bits) 
that can be extracted from the state together with the amount 
of entanglement needed to generate the state, i.e., distilla- 
tion and generati on being reversible for pur e states (in the 
asymptotic limit) jNielsen and Chuangj |2000|) . Any bipartite 
pure Gaussian state can be mapped, using local Gaussian uni- 
taries, into a te nsor product of EPR states of covariance matrix 



ffii. V eprft^fc) (iBotero and Rezni3 , l2003llHolevo and Werneii 
l200lh . ALOCC mapping a Gaussian pure state to another one 
exists if and only if i^k > v'^, for a ll k, where their resp ective 
Vk and v'f. are in descending order (iGiedke et a/.ll2003l) . 

Unfortunately, for mixed states we do not have a single def - 
inition of measure of entanglement jHorodecki et al. I l2009h . 
Different candidates exist, each one with its own operational 
interpretation. Am ong the most well known is the e ntangle- 
ment of formation (iBennett. DiVincenzo. et a/.lll996b . 



{pk,\'Pk)} 



PkEv{\(pk)) , 



(60) 



where the minimization is taken over all the possible decom- 
positions p = J2kPk \Vk) (<y2fe| (the sum becomes an integral 
for continuous decompositions). In general, this optimiza- 
tion is very difficult to carry out. In continuous variables, 
we only k now the solution for two-mode symmetric Gaus- 
sian states jGiedke et all l2003b . These are two-mode Gaus- 
sian states whose covariance matrix is symmetric under the 
permutation of the two modes, i.e., A = B in Eq. ( |53] |. where 
Ep{p) is then a function of ;>_. Interestingly the optimal de- 
composition {pk, Ifk)} leading to this result is obtained from 
Gaussian states \ (pk)- This is conjectured to be true for any the 
Gaussian state, i.e., the Gaussian entanglement of formation 
GEp{p), defined by the minimizatio n over Gaussian de com- 
positions satisfies GEp{p) = Ep{p) dWolf et al. I I2OOI . 

The distillable entanglement D{p) quantifies the amount of 
entanglement tha t can b e distilled from a given mixed state p 
(iHorodecki et a/.ll2009l) . It is easy to see that D{p) < Ep{p), 
otherwise we could generate an infinite amount of entangle- 
ment from finite resources, where for pure states we have 
D{\^j)) = Ep{\iP)) = Ev{\ij)). The entanglement dis- 
tillation is also hard to calculate, as it needs an optimiza- 
tion over all possible distillation protocols. Little is known 
about D{p) for Gaussian states, except trivial lower-bounds 
given by the coherent information dOevetak and Winteill2004l) 



and its reverse counterpar t (iGarcfa-Patron et al. I I2OO9I) . In 
IGiedke. Duan. et al\ (I2OOII) it was shown that bipartite Gaus- 
sian states are distillable if and only if they have a non-positive 
partial transpose. However, the distillation of mixed Gaus- 
sian states into pure Gaussian states is not possible using 
only Gaussian LOCC operations dEisert et a/.Ll2002l: lF mrasekl 
l2002at IGiedke and Cirad |2002|) . but can be achieved using 
non-Gauss ian operations that m ap Gaussian states into Gaus- 
sian states (iBrowne ef a/.ll2003l) . as recently demonstrated by 
iTakahashi et al\ (I2OIOI) . 

The two previous entanglement measures, i.e., Ep{p) and 
D{p), are unfortunately very difficult to calculate in full gen- 
erality. Howev er, a measure easy to com pute is the logarith- 
mic negativity (IVidal and Wernerll2002l) 



EN{p)=\og\\(F-\\^ 



(61) 



which quantifies how much the state fails to satisfy the posi- 
tivity of the partial transpose condition. For Gaussian states it 
reads 



Er,{p) = Y,F{V^) 



(62) 



where F (x) = —\og{x) for x < 1 and F{x) = for 
X > 1 (IVidal and Wernei , 20021). It was shown t o be an 



entanglement monotone ('Eisert', '2001'; 'Plenio|, |2005|) and an 
upperboundof D{p) tVidal and Werneitl2002b . The logarith- 
mic negativity of 1 x M a nd N x M bisymmetric Gau ssian 
states was ch a racteri zed bv lAdesso and Illuminatil(l2007h and 
lAdesso et al.\ ( |2004|) . respectively. Finally, we briefly men- 
tion that although the separability of a quantum state implies 
zero entanglement, other types of quantum correlations can 
exist for separable (non-entangled) mixed states. One mea- 
sure of such correlations is the quantum discord and has re- 
cently bee n extended to Gau ssian states (lAdesso and Dattai 
I2OIO: Giorda and Parisl l2010l) . 



E. Measuring Gaussian states 

A quantum measurement is described by a set of opera- 
tors {Ei} satisfying the completeness relation J^i ^l^i = ^ 
where / is the identity operator Given an input state p, 
the outcome i is found with probability pi = TT{pEj Ei) 
and the state is projected onto pi ~ p.^ EipEl. If we are 
only interested in the outcome of the measurement we can 
set Hi := E^Ei and describe the measurement as a positive 
operator-valued measure (POVM). In the case of continuous- 
variable systems, quantum measurements are often described 
by continuous outcomes i e M, so that pi becomes a probabil- 
ity density. Here we define a measurement as being Gaus- 
sian when its application to Gaussian states provides out- 
comes which are Gaussian-distributed. From a practical point 
of view, any Gaussian measurement can be accomplished us- 
ing homodyne detection, linear optics (i.e., active and passive 
Gaussian unitaries), and Gaussian ancilla modes. A general 
property of a Gaussian measurement is the following: suppose 
a Gaussian measurement is made on N modes of an + Al 
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Gaussian state where N,M > 1; then the classical outcome 
from the measurement is a Gaussian distribution and the un- 
measured M modes are left in a Gaussian state. 



(vacuum) modes followed by homodyne measurements on all 
the output modes. Finally, a general noisy Gaussian POVM 
is modeled as before but with part of the output modes traced 
out. 



1 . Homodyne detection 

The most common Gaussian measurement in continuous- 
variable quantum information is homodyne detection, con- 
sisting of the measurement of the quadrature q (or p) of a 
bosonic mode. Its measurement operators are projectors over 
the quadrature basis \q) {q\ (or \p) {p\), i.e., infinitely squeezed 
states. The corresponding outcome q (or p) has a probability 
distribution P{q) (or P{p)) which is given by the marginal in- 
tegral of the Wigner function over the conjugate quadrature, 
i.e., 

P{q)= J W{q,p)dp, P{p)^ J W{q,p)dq. (63) 

This can be generalized to the situation of partially homodyn- 
ing a multimode bosonic system by including the integration 
over both quadratures of the non-measured modes. Experi- 
mentally a homodyne measurement is implemented by com- 
bining the target quantum mode with a local oscillator into a 
balanced beam splitter and measuring the intensity of the out- 
going modes using two photo-detectors. The subtraction of 
the si gnal of both photo-detectors give s a signal proportional 
to q (iBraunstein and van Loockl l2005h . The p quadrature is 
measured by applying a 7r/2 phase shift to the local oscil- 
lator. Corrections due to bandwidth effec ts or limited local 
oscillator power have a l so bee n addressed (lBraunsteinl[l990t 
IBraunstein and CrouchL[l99ll) . Homo dyne detection is also a 
powe rful tool in quantum tomography jLvovskv and Ravmeil 
I2OO9I) . For instance, by using a single homodyne detector, 
one can experimentally re construct the covar i ance matrix of 
two-m ode Gaussian states dBuono et al. 
I2OO9I) . In tandem to well known homodyne measurements 
on light, homodyne measurements of the atomic Gaussian 
spin states via a quantum non-demolition measurement by 
light have also been developed. For example, the work of 
iFernholz et al\ (l2008l) demonstrated the quantum tomographic 
reconstruction of a spin squeezed state of the atomic ensem- 
ble. 



2. Heterodyne detection and Gaussian POVIVIs 

The qu antum theory of heterod yne detection was estab- 
lished by lYuen and Shapirol ( Il980h and is an important ex- 
ample of a Gaussian POVM. Theoretically, heterodyne de- 
tection corresponds to a projection onto coherent states, i.e., 
E{a) :~ 7r~^/^ \a) {a\. A heterodyne detector combines the 
measured bosonic mode with a vacuum ancillary mode into a 
balanced beam splitter and homodynes the quadratures q and 
p of the outcome modes. This approach can be generalized to 
any POVM c omposed of projectors ove r pur e Gaussian states. 
As sho wn by iGiedke and Cirad ( |2002|) and lEisert and Pleniol 
(l2003h . such measurements can be decomposed into a Gaus- 
sian unitary applied to the input system and extra ancillary 



3. Partial Gaussian measurement 

When processing a quantum system we are usually inter- 
ested in measuring only part of it (for example, subsystem 
B which contains 1 mode) in order to extract information 
and continue processing the remaining part (say, subsystem A 
with N modes). Let us consider a Gaussian state for the global 
system A + B where the covariance matrix is in block form 
similar to Eq. (l53T l (but with + 1 modes). Measuring the 
q quadrature of subsystem B tr ansforms the covariance ma- 
trix of subsystem A as follows dEisert et al. ll200 llFiurasea 
l2002ah 



v = A c(nBn) 



(64) 



where 11 diag(l,0) and (riBII)^^ is a pseudoinverse 
since IIBn is singular. In particular, we have (IIBn)^^ = 
Sf/n, where Bn is the top-left element of B. Note that 
the output covariance matrix does not depend on the specific 
result of the measurement. This technique can be generalized 
to model any partial Gaussian measurement, which consists of 
appending ancillary modes to a system, applying a Gaussian 
unitary, and processing the output modes as follows: part is 
homodyned, another part is discarded and the remaining part 
is the output system. As an example, we can easily derive 
the effect on a multi-mode subsystem A after we heterodyne 
a single-mode subsystem B. By heterodyning the last mode, 
the first N modes are still in a Gaussian state, and the output 
covariance matrix is given by 

V = A-C(B + I)-iC^, (65) 

or, equivalently, V = A - 8"iC(a;Bu;^+I)C^, where 
6 := det B + TrB + 1, and w is defined in Eq. dH. 



4. Counting and detecting pliotons 

Finally, there are two measurements, that despite being 
non-Gaussian, play an important role in certain Gaussian 
quantum information protocols, e.g., distinguishability of 
Gaussian states, entanglement distillation and universal quan- 
tum computation. The first one is the von Neumann measure- 
ment in the number state basis, i.e.. En := \n) {n\. The 
second one is the avalanche photo-diode that discriminates 
between vacuum Eq ~ |0) (0| and one or more photons 
i?i = / — |0) (0|. Realistic avalanche photo-diode detectors 
usually have small efficiency, i.e., they detect only a small 
fraction of the impinging photons. This is modeled theoret- 
ically by adding a beam splitter before an ideal avalanche 
photo-diode detector, with transmissivity given by the effi- 
ciency of the detector. Recent technological developments 
allow experimentalists to approach ideal photon-c ounting ca- 
pabili ty for photon numbers of up to five to ten dLita et all 
l2008h . 
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III. DISTINGUISHABILITY OF GAUSSIAN STATES 

The laws of quantum information tell us that in 
general it is impossible to perfectly distinguis h be- 
tween two non-orthogona l quantum states (iFuchsi l2000t 
iNielsen and Chuan^ 2000l). This lim itation of quantum mea- 
surement theory ( Helstrornl 1 1976b is inherent in a num- 
ber of Gaussian quantum information protocols including 
quantum cloning and the security of quantum cryptogra- 
phy. Closely related to this is quantum state discrimination 
which is concerned with the distinguishability of quantum 
states. There are two commonly used disti nguishability tech- 
niques dBergou et al\. l2004t ICheflesL l2000h : (1) minimum er- 
ror state discrimination, and (2) unambiguous state discrimi- 
nation. In minimum error state discrimination, a number of 
approaches have been developed which allows one to (imper- 
fectly) distinguish between quantum states provided we allow 
a certain amount of uncertainty or error in our measurement 
results. On the other hand, unambiguous state discrimina- 
tion, is an error-free discrimination process but relies on the 
fact that sometimes t he observer gets an inconclusive result 
dChefles and Barnetli Il998bl: lEnH |2002|) . There also exists 
an intermediate discrimination r egime which allows f or both 
errors and inconclusive results (IChefles and Barnettl Il998at 



2010ah . 



Here we discuss 



iFiurasekl 120031: IWittmann ef aZl 
minimum error state discrimination which is more developed 
than unambiguous state discrimination in the continuous- 
variable framework particularly in the case of Gaussian states. 

This section is structured as follows. In Sec. 1111. Al we begin 
by introducing some of the basic measures of distinguishabil- 
ity, such as the Helstrom bound, the quantum Chernoff bound 
and the quantum fidelity. We give their formulation for arbi- 
trary quantum states, providing analytical formulas in the spe- 
cific case of Gaussian states. Then, in Sec. 1111. Bl we consider 
the most common Gaussian discrimination protocol: distin- 
guishing optical coherent states with minimum error 



A. Measures of distinguishability 

1 . Helstrom bound 

Let us suppose that a quantum system is described by an un- 
known quantum state p which can take two possible forms, po 
or pi, with the same probability (more generally, the problem 
can be formulated for quantum states which are not equiprob- 
able). For discriminating between po and pi, we can ap- 
ply an arbitrary quantum measurement to the system. With- 
out loss of generality, we can consider a dichotomic POVM 
{XIojIIi := / — IIo} whose outcome u = 0, 1 is a logical 
bit solving the discrimination. This happens up to an error 
probability 



Pe 



p(u = 0|p = pi) + p{u = l|p = po) 



(66) 



where p{u\p) is the conditional probability of getting the out- 
come u given the state p. Then we ask: what is the minimum 
error probability we can achieve by optimizing over the (di- 
chotomic) POVMs? The answer to this question is provided 



by the Helstrom bound (iHelstroml Il976h . Helstrom showed 
that an optimal POVM is given by Hi = P(7+), which is a 
projector onto the positive part 7+ of the non-positive opera- 
tor 7 := Po — pi, known as the Helstrom matrix. As a result, 
the minimum error probability is equal to the Helstrom bound 

Pe.min = ^ [1 - (PO , Pi )] , (67) 



where 



DipoJi) := Jxr |po - pi| = 1 ^ |A,|, (68) 



is the trace distance bet ween the two quantum states 
(iNielsen and Chuangl I2OO0I) . Here Y.\^j\ 

is the summation 

of the absolute values of the eigenvalues of the matrix po — pi. 
In the case of two pure states, i.e., po = \tpo) (V'ol and 
Pi = IV'i) ii^il' the Helstrom bound takes the simple form 



1 



(69) 



2. Quantum Chernoff bound 

In general, deriving an analytical expression for the trace 
distance is not easy and, therefore, the Helstrom bound 
is usually approximated by other distinguishability mea- 
sures. One of the most recent is the quantum Chernoff 



bound ([Audenaert et al.[ l2 ()07ll2008tlCalsamigUa et a/.Ll2008t 



iNussbaum and Szkola. 2009 ). This is an upper bound Pe, mm < 



Pqc, defined by 



PQC 



:= - I inf C. 

2 Vo<s<i 



, Cs := Tr (pgpj-^) 



(70) 



Note that the quantum Chernoff bound involves a minimiza- 
tion in s e [0, 1]. In particular, we must use an infimum be- 
cause of possible discontinuities of Cs at the border s = 0, 1. 
By ignoring the minimization and setting s = 1/2, we derive 
a weaker but easier-to-compute upper b ound. This is known 
as the quantum Bhattacharyya bound dPirandola and Llovdl 
l2008h 



PB 



-Tr 



' Pi)\J P\ 



(71) 



a. General formula for multimode Gaussian states 

In the case of Gaussian states the quantum Chernoff 
bound can be computed from the first two statistical mo- 
ments. A first formul a, valid for singl e -mode Gaussian 
states, was shown by Calsamiglia et al.\ ( |2008[) . Later, 
iPirandola and Llovdl ( 12008 ) provided a general formula for 
multimode Gaussian states, relating the quantum Chernoff 
bound to the symplectic spectra (Williamson forms). Here we 
review this general formula. Since it concerns the term Cs in 
Eq. ( iTOl ). it also applies to the quantum Bhattacharyya bound. 
First of all it is useful to introduce the two real functions 



Gsix) ■.= 2" [{x + lf ~{x-lf 



(72) 
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and 



A.(x) 



{x + iy + jx-iY 
(x + iy-ix-iy 



(73) 



which are positive for x > 1 and s > 0. These functions can 
be computed over a WilHamson form V® via the rule 



N 



N 



/(v®) = / =0/K)i 



(74) 



k=l 



Using these functions we ca n state the following re- 
sult (iPirandola and LloyJ, l2008h . Let us consider two iV- 
mode Gaussian states, po{5co, Vq) and pi(xi, Vi), whose co- 
variance matrices have symplectic decompositions 

Vo = SoV®Sj , Vi = SiVf . (75) 

Then, for every s e (0, 1), we can write the Gaussian formula 



where A := det(Vo + Vi), 6 := (dot Vn - l)(dct Vi - 1) 
and d := xi — xp. Using the fideli t y, we can define the two 
fidelity bounds (iFuchs and de GraafL[l999l) 



1- Vl-^(Po,Pi) 



(81) 

which provide further estimates for the minimum error prob- 
ability. In particular, they satisfy the chain of inequalities 



F- < Pe,mm < PQC < PB < F^ 



(82) 



4. Multicopy discrimination 



In general, let us assume that we have M copies of the un- 
known quantum state p, which again can take the two possible 
forms, pq or pi, with the same probability. In other words, we 
have the two equiprobable hypotheses 



C' 



dctn. 



detS, 
where d := xq — xi and 



■ cxp 



G,,(V®)Gi_,,(Vf) 



:= So [A,(V®)] + Si [Ai_,(Vf )] Sf 



(76) 



(77) 
(78) 



In the previous formula, the matrix Ilg is diagonal and very 
easy to compute, depending only on the symplectic spectra. In 
particular, for pure states (V® = Yf ~ I) we have lis = I- 
By contrast, the computation of is not straightforward due 
to the explicit presence of the two symplectic matrices Sq and 
Si, whose derivation may need non-trivial calculations in the 
general case (however see |ll.C.3] for two modes). If the com- 
putation of So and Si is too difficult, one possibility is to use 
weaker bounds which depend on the symplectic spectra o nly, 
such as the Minkowski bound dPirandola and Llovdi l2008b . 



3. Quantum fidelity 

Further bounds can be constructed using the quantum fi- 
delity. In quantum teleportation and quantum cloning, the fi- 
delity F is a commonly used measure to compare the input 
state to the output state. Gi ven two quantum states, pp an d pi, 
their fidelity is defined by (IJozsal 1 1 994 lUhknanni [l976l) 



' Po , 

' Pi ■ 



(83) 
(84) 



M 



The optimal quantum measurement for discriminating the two 
cases is now a collective measurement involving all the M 
copies. This is the same dichotomic POVM as before, now 
projecting on the positive part of the Helstrom matrix 7 = 
Pq^ — pf^^. Correspondingly, the Helstrom bound for the 
M -copy state discrimination takes the form 



pi% = l[^-Dipr,p?'')] 



(85) 



This quantity is upper bounded by the general A/-copy ex- 
pression of the quantum Chernoff bound, i.e.. 



JM) (M) 
Pe,mm — PqC 



1 ( inf a 

2 Vo<s<i 



M 



(86) 



Interestingly, in the limit of many copies ( M ^ 1), the quan- 
tum Chernoff bound is exponentially tight dAudenaert et al.l 
l2007h . This means that, for large A/, the two quantities p], Ji„ 

and PqU decay exponentially with the same error-rate expo- 
nent, i.e.. 



F{po,Pi) 



Tr 



(79) 



which ranges from zero (for orthogonal states) to one 
(for identical states). In the specific case of two single- 
mode G a ussian states, pn(^niVn) an d pi (x i , Vi ), we have 
dHoleyol 1 19751 iNha and Carmichaell 120051: lOhvares et all 
l2006HScutarulll998h 



F{po,pi) = 



cxp 



4d-(V„ 



Vi] 



(80) 



PeMn ^ ^ exp{-MK) , p)^y ^ ^ exp(-AfA^) , (87) 

where d < v and k is known as t he quantum Chernoff in- 
formation ( Calsamiglia et ali . l2008l) . Note that we can also 
consider other measures of distinguishability, like the A/-copy 
version of the quantum Bhattacharyya bound 



(M) ^ (A/) 

Pqc < Pb 



1 r, 
2 



Tr 



'Pay Pi 



M 



(88) 



However, even though it is easier to compute, it is not expo- 
nentially tight in the general case. 
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B. Distinguishing optical colierent states 

The distinguishing of coherent states with minimum error 
is one of the fundamental tasks in optical communication the- 
ory. For example, we can consider a simple theoretical way 
of modeling current telecommunication systems by consid- 
ering weak coherent states to send binary information which 
has been encoded via the amplitude or phase modulation of a 
laser beam^. Such states have small amplitudes and are largely 
overlapping (i.e., nonorthogonal) and hence the ability to suc- 
cessfully decode this classical information is bounded by the 
minimum error given the Helstrom bound. Note that starting 
off with orthogonal states might make more sense, however, if 
orthogonal states were to be used their orthogonality is typi- 
cally lost due to real world imperfections such as energy dissi- 
pation and excess noise on the optical fibre. By achieving the 
lowest error possible, the information transfer rate between 
the sender and receiver can be maximized. We will now illus- 
trate a typical protocol involving the distinguishing of coher- 
ent states. 

Suppose we have a sender, Alice, and a receiver. Bob. Al- 
ice prepares one of two binary coherent states po and pi where 
one may be encoded as a logical "0" and the other a logical 
"1", respectively. These two states form what is known as 
the alphabet of possible states from which Alice can choose 
to send and whose contents are also known by Bob. Further- 
more, the probabilities of each state being sent, po and pi, are 
also known by Bob. Alice can decide to use either an am- 
plitude modulation keyed encoding, or a binary phase-shift 
keyed encoding, given respectively as. 



|0) and |2a), |a) and |-a) 



(89) 



We note that it is possible to transform between the two en- 
coding schemes by using a displacement, e.g., by applying the 
displacement operator D{a) to each of the two binary phase- 
shift keyed coherent states we retrieve the amplitude modu- 
lation keyed encodings: D{a) \—a) = |0) and D{a) \a) = 
\2a). Bob's goal is to decide with minimum error, which of 
the two coherent states he received from Alice (over, for ex- 
ample, a quantum channel with no loss and no noise). Bob's 
strategy is based on quantum hypothesis testing in which he 
devises two hypotheses: Hq and Hi. Here Hq corresponds to 
the situation where po was sent whilst Hi corresponds to pi 
being sent. As mentioned earlier, the POVM that optimizes 
this decision problem is actually a projective or von Neumann 
measurement, i.e., described by the two operators Hq and Hi, 
such that n,; > for i = 0, 1 and Ho + Hi = /. Here the 
measurement described by the operator XIq selects the state po 



while Hi = /— Ho selects pi. The probability of error quanti- 
fies the probability in misinterpreting which state was actually 
received by Bob and is given by 



Pe ^ Po p{Hi\po) + pi p{Ho\pi), 



(90) 



where p{Hi\pj) is defined as the conditional probability, i.e., 
probability that Bob decided it was hypothesis Hi when in 
fact it was pj, for i j. The conditional probabilities can be 
written as 



piHi\po) - trpipo], p{Ho\pi) = trpopi] 



(91) 



Consequently, in the binary phase-shift keyed setting we can 
write the Helstrom bound as 



Pe 



Pq {a\ III \a) +pi Uq 



(92) 



and for the amplitude modulation keyed encoding 

Pe=po{0\lli\0)+pi{2a\no\2a). (93) 

The optimal type of measurement needed to achieve the 
Helstrom bound when distinguishing between two coher- 
ent states was shown (Helstrom, 1976) to correspond to a 
Schrodinger cat-state basis (i.e . , a su perposition of two co- 
herent states (iJeong and RalphL l2007h '): Ho = \ip) with 
lip) = Co (7) |0) + €1(7) 1 7) where the actual weightings (ci 
and C2) depend on the displacement 7. After Helstrom in- 
troduced his error probability bound in 1968, it was not un- 
til 1973, that two different physical models of implement- 
ing the receiver were discovered. The first construction, by 
iKennedvl (Il973h . involved building a receiver based on di- 
rect detection (or photon counting) that was near-optimal, 
i.e., an error probability that was larger than the optimal Hel- 
strom bound. However, building on Kennedy's initial pro- 
posal, iDolinaj ( Il973h discovered how one could achieve the 
optimal bound using an adaptive feedback process with pho- 
ton counting. Over the years other researcher s have con 



tinued to make further progress in thi s area jBonduranl , 



1993 



iGeremiai 120041: lOlivares and Parisl 12004 lOsaki etal 



19961) . Recently, Kennedy's original idea was improved upon 
with a receiver that was much simpler to implement than 
Dolinar's (although still near-optimal) but produced a smaller 
error probability than Kennedy's. Such a device is ca l led an 
optimized displacement receiver (iTakeoka and Sas ^ l2008t 
IWittmann et al.. 2008). However, the simplest possible re- 
ceiver to implement is the conventional homodyne receiver, 
a common element in optical communication which is also 
near-optimal outperforming the Kennedy receiver, albeit only 
for small coherent amplitudes. We will now review each of 
these receivers in more detail. 



^ More specifically, fiber communications cuiTently employ in-line optical 
amplifiers, so the states that are received are bathed in amplified sponta- 
neous emission noise and, moreover, received by direct detection. Future 
fiber systems - in which bandwidth efficiency is being sought - will go to 
coherent detection, but they will use much larger than binary signal con- 
stellations, i.e., quadrature amplitude modulation. Laser communication 
from space will use direct detection and Af-ary pulse-position modulation 
rather than binary modulation. 



1 . Kennedy receiver 

IKennedvl (1 1973h gave the first practical realization of a re- 
ceiver with an error probability twice that of the Helstrom 
bound. The Kennedy receiver distinguishes between the al- 
phabet I a) and |— a) by first displacing each of the coherent 
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states by a, i.e., \—a) — >■ |0) and \a) |2q!). Bob then 
measures the number of incoming photons between the times 
t = and t = T using direct photon counting, represented by 
the operators 



Hi = |0) (0| and Ha = / - |0) (0| 



(94) 



If the number of photons detected during this time is zero 
then |0) is chosen (as the vacuum contains no photons) oth- 
erwise it is assumed to have been \2a). Hence, the Kennedy 
receiver always chooses |0) correctly (ignoring experimental 
imperfections), where the error in the decision results from 
the vacuum fluctuations in \2a) (as any coherent state has 
some finite overlap with the vacuum state). Using Eq. ( |93] ). 
where from now on we use the least classical probability sit- 
uation of pi = P2 = 1/2, the error probability is given by 



Pe 



i {2a\ Hi \2a) which is equal to 



Pe 



■exp(-4|ap). 



(95) 



where we have used Eq. (l30l l. The above error bound is some- 
times known as the shot-noise error. 



2. Dolinar receiver 



and |— a). Such a setup is considered the simplest setup pos- 
sible and unlike the other receivers relies only on Gaussian 
operations. The POVMs for the homodyne receiver are mod- 
eled by the projectors 



Hi 



dx\x) {x\ and 112 = / — Hi, 



(96) 



where a positive (negative) outcome is obtained identifying 
\q) (|— a)). It was proven bv iTakeokaand S asaki (2008) that 
the simple homodyne detector is optimal among all available 
Gaussian measurements. In fact, for weak coherent states 
(amplitudes jap < 0.4), the homodyne receiver is near- 
optimal and has a lower error probability than the Kennedy 
receiver. Such a regime corresponds to various quantum 
communication protocols as well as deep space communi- 
cation. Using Eq. ( |92] ) with the projectors from Eq. ( |96b 
and the fact that | (-a|x)p = tt^^/^ exp[-(x + |a|/2)2], 
the error probability for the homodyne receiver is given 
by dOUvares and ParisL 120041: iTakeoka and SasakiLl2008l) 



Pe 



erf 



\a\l2 



(97) 



where erf [•] is the error function. This limit is known as the 
homodyne limit. 



iDolinaij d 19731) built upon the results of Kennedy by con- 
structing a physical scheme that saturates the Helstrom bound. 
Using Eq. ( |69] l with Eq. ( l30t , the Helstrom bound for two pure 
coherent states \a) and |— a) is given by 

Pe,,nin = ^(1 - V^l - CXp(-4| a| 2) ) . 

This is the lowest possible error in distinguishing between 
two pure coherent states. Dolinar's scheme combined pho- 
ton counting with real-time quantum feedback. Here the in- 
coming coherent signal is combined on a beam splitter with a 
local oscillator whose amplitude is causally dependent on the 
number of photons detected in the signal beam. Such an adap- 
tive process is continually repeated throughout the duration of 
the signal length where a decision is made b ased on the par- 
ity of the final number of photons dete cted (IGeremi ^ l200i 
iHelstroml 1 19761: iTakeoka et al. 1 l2005h . Many years after 
Dolinar's proposal, other ap proaches, such as u sing a highly 
nonlinear uni tary operation (ISasaki and Hirotal [T996) or fast 
feedforward (ITakeoka et a/.ll2bo5l) . have also achieved the 
Helstrom bound by approximating the required Schrodinger 
cat state measurement basis (the a ctual creation of such a bas is 
is experimentally very difficult dOurjoumtsev et al\. 120071) '). 
However, an experimental implementation of Dolinar's orig- 
inal approach was recently demonst rated in a proof-of- 
principle experiment dCook et a/.ll2007l) . 



3. Homodyne receiver 

As its name suggests the homodyne receiver uses a homo- 
dyne detector to distinguish between the coherent states \a) 



4. Optimized displacement receiver 



Th e optimized displacement receiver dTakeoka and Sas 
l2008h is a modification of the Kennedy receiver where instead 
of displacing \a) and |— a) by a, both are now displaced by an 
optimized value /3, where a, /3 € M. This displacement D{(5) 
is based on optimizing both terms in the error probability of 
Eq. d92l ). When considering the Kennedy receiver, only the 
Pi {—a\ lii \—a) term is minimized. However, the optimized 
displacement receiver, is based on optimizing the sum of the 
two probabilities as a function of the displacement (3. The 
signal states |±a) are now displaced by j3 according to 



|±a) ^ |±^/7a + /3), 



(98) 



for a transmission t in the limit of t 1. As with the 
Kennedy receiver photon detection is used to detect the in- 
coming states and is described by the projectors given in 
Eq. d94l ). Using Eqs. d92] i and d30b but with the coherent states 
now given by Eq. d98] ), the error probability can be expressed 
as 



Pe 



exp[— (rjal' 



^)]sinh(2V7a;3). 



(99) 



The optimized displacement receiver outperforms both the ho- 
modyne receiver and the Kennedy receiver for all values of a. 
It is interesting to note that such a receiver has applications in 
quantum cryptography where it has been s hown to increase 
the se cret-key rates of certain protocols (IWittmann et a/.l 
l2010allbl) . Furthermore, by including squeezing with the dis- 
placement, an im provement in the performan ce of the receiver 
can be achieved dTakeoka and Sasakil l2008h . The optimized 
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displ acement receiver has also been demonstrated experimen- 
tally dTsuiino et al. I bOllHWittmann et al. I I2OO8I) . 

To summarize, in terms of performance, the hierarchy for 
the above mentioned receivers is the following: (1) Dolinar 
receiver, (2) optimized displacement receiver, (3) Kennedy 
receiver and (4) homodyne receiver Again, out of the ones 
mentioned, the Dolinar receiver is the only one that is optimal. 
Furthermore, the Kennedy receiver has a lower error probabil- 
ity than the homodyne receiver for most values of amplitude. 
Finally, we point out that our discussions of binary receivers 
(photon counters) presumes unity quantum efficiency with no 
dark noise or thermal noise, and hence paints an ideal theoret- 
ical comparison between all of the mentioned receivers. 



IV. EXAMPLES OF GAUSSIAN QUANTUM PROTOCOLS 

A. Quantum teleportation and variants 

Quantum teleportation is one of the most beautiful 
protocols i n quantum in f ormati on. Originally developed 
for qubits (iBennett et al\. Il993h. it was later extended to 
continuous-variable systems dBraunstein and Kimblel Il998t 



iRalph and Lamlll998irv^dman[ 1994h . where coherent states 
are teleported via the EPR correlations shared by two dis- 
tant parties. It has also been demonstrated experimen- 



tally dBowen et a/.ll2003llFurusawa et a/.lll998Hzhang et al\. 
l2003h . Here we review the quantum tele portation protocol for 
Gaussian states using the formalism of ( Chizhov et al\. 120021: 



IFiurasekL l2002bHPirandola and Mancini l200d) . 

Two parties, say Alice and Bob, possess two modes, a and 
h, prepared in a zero-mean Gaussian state p(0, V) whose co- 
variance matrix V can be written in the (A, B, C)-block form 
of Eq. (|53] |. This state can be seen as a virtual channel that 
Alice can exploit to transfer an input state to Bob. In prin- 
ciple the input state can be completely arbitrary. In practical 
applications she will typically pick her state from some previ- 
ously agreed alphabet. Consider the case in which she wishes 
to transfer a Gaussian state /5i„(xi„, Vi„), with fixed covari- 
ance matrix Vi„ but unknown mean Xi„ (chosen from a Gaus- 
sian distribution), from her input mode in to Bob. To accom- 
plish this task, Alice must destroy her state pin by combining 
modes in and a in a joint Gaussian measurement, known as 
a Bell measurement, where Alice mixes in and a in a bal- 
anced beam splitter and homodynes the output modes, — and 
+ by measuring g_ and respectively. The outcome of the 
measurement 7 := [q^ + ip+)/2 is then communicated to 
Bob via a standard telecom Une. Once he receives this infor- 
mation. Bob can reconstruct Alice's input state by applying 
a displacement £'(7) on his mode 6, which outputs a Gaus- 
sian state Pout — Pin- The performance of the protocol is 
expressed by the teleportation fidelity F. This is the fidelity 
between the input and the output states averaged over all the 
outcomes of the Bell m easurement. Assu ming pure Gaussian 
states as input, one has jFiurase g. l2002bl) 



where again Z : = diag(l, —1). This formula can be gener- 
alized to virtual channels /5(x, V) with arbitrary mean x = 
{Qa,Pa, qb,Pb)'^ ■ This is possible if Bob performs the modi- 
fied displacement Z3(7 + 7), where 7 := [{qi, — qa) — i{pb + 
Pa)]/2V2 dPirandola and ManciniLr2006h . 

In order to be truly quantum, the teleportation must have 
a fidelity above a classical threshold F^ass- This value cor- 
responds to the classical protocol where Alice measures her 
states, communicates the results to Bob who, in turn, recon- 
structs the states from the classical information. In general, 
a necessary condition for having F > Fdass is the pres- 
ence of entanglement in the virtual channel. For bosonic 
systems, this is usually assured by the presence of EPR cor- 
relations. For instance, let us consider the case where the 
input states are coherent states chosen from a broad Gaus- 
sian distribution and the virtual channel is an EPR state 
ffP'^{r). In this case, the teleportation fidelity is simply 
given by dAd esso and Illuminatill2005l : lFurusawa et a/"lll998t 
iMari and vitali , 2008;) 



F={1 



V- = exp(— 2 I 



(101) 



Here the presence of EPR correlations (r > 0) guarantees 
the presence of entanglement (;>_ < 1) and, correspond- 
ingly, one has F > 1/2, i.e., the fidelity beats the clas- 
sical t hreshold for coh e rent s tates dBraunstein. Fuchs et ail 
I2OOII iHammerer et al. I l2005h . A more stringent thresh- 
old for teleportation is to require that the quantum correla- 
tions b etween the input field and the teleported field are re- 
tained dRalphandLamlll998l) . In turn this implies that the 
teleported field is th e best copy of the input allowed by the 
no-cloning bound (Gros shans and G rangier, 2001). At unity 
gain this requires that £>_ < 1/2 and corresponds to a co- 
herent state fideli ty F > 2/3 as was first demonstrated by 
iTakei ef a/.ld2005b . 

In continuous variables, the protocol of quantum teleporta- 
tion has been extende d in several ways, inclu d ing nu mber- 
phase teleportation ( Milburn and Braunsteinl 1 19991) . all- 



optical tel eportation | Ralph', 'l999b|), quan tum teleportation 
networks (Ivan Loock and Braunsteinl 2000l). t e leport ation of 



single photon stat es ilde et all 12001 



Ralphl l200lh . quan 



F : 



VdctT 



2V,„+ZAZ+B-ZC-C^Z^. (100) 



tum telecloning (jyan Loock and Braunstein', '200 1|), quan- 
tum gate teleportation (Bartlett and M unro, 2003), assisted 
quantum teleport ation (IPir andola et all 120051) . quantum tele- 
port ation games ( Pirandolat i2005l) . and teleportation chan- 
nels (IWolfef a/.Ll2007h . One of the most important variants of 
the protocol is the teleport ation of entanglement also known 
as entanglement swapping i JisL ef aZll2004tlTakei eFal. I I2OO5I 
Ivan Loock and Braunsteinl 19991) . Here AUce and Bob pos- 
sess two entangled states, paa' and pbi,/, respectively. Alice 
keeps mode a and sends mode a' to a Bell measurement, while 
Bob keeps mode b and sends b' . Once a' and b' are measured 
and the outcome communicated, Alice and Bob will share an 
output state pat, where a and b are entangled. For simplic- 
ity, let us suppose that Alice's and Bob's initial states are EPR 
states, i.e., paa' = Phh' = p'^^^(r). Usi ng the input-output re- 
lations given in IPirandola et al. I (l2006l) . one can easily check 
that the output Gaussian state pab has logarithmic negativity 
EniPab) = lncosh(2r), corresponding to entanglement for 
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every r > 0. By generalizing to two-mode entanglement, 
polarization entanglement can be s wapped and shown to still 
violate a Bell inequality for r > dPolkinghorne and RalphL 
Il999l) . 

Teleportation and entanglement swapping are protocols 
which may involve bosoni c syste ms of different nature. For 
example, in ISherson et al.\ ( l2006l) a quantum state was tele- 
ported from an optical mode onto a macroscopic object con- 
sisting of an atomic ensemble of about 10^^ Caesium atoms. 
Theoretically, this kind of result can also be realized by using 
radiation pressure. In fact, by impinging a strong monochro- 
matic laser beam onto a highly reflecting mirror, it is possi- 
ble to generate a scattering process where an optical mode 
becomes entangled with an acoustic (massive) mode excited 
over the surface of the mirror Exploiting this hybrid entan- 
glement, the teleportati on from an optical to an acoustic mode 
is pos sible in principle dMancini et al. 1 120031: iPirandola et ali 
l2003l) . as well as the generation of entanglement between 
two acoustic modes b y means of entanglement swapping 
dPirandolaef a/.Ll2006h . 



B. Quantum cloning 



according to 



Following the seminal works o f lWootters and Zurekid 19821) 
and iDieksl (il982h . it is well known that a quantum transfor- 
mation that outputs two perfect copies of an arbitrary input 
state is precluded by the laws of quantum mechanics. 
This is the content of the celebrated quantum no-cloning the- 
orem. More precisely, perfect cloning is possible, if and only 
if, the input state is drawn from a set of orthogonal states. 
Then, a simple von Neumann measurement enables the per- 
fect discrimination of the states (see Sec. HIlli. which in turn 
enables the preparation of exact copies of the measured state. 
In contrast, if the input state is drawn from a set of non- 
orthogonal states, perfect cloning is impossible. A notable 
example of this are coherent states which cannot be perfectly 
distinguished nor cloned as a result of Eq. d30l l. Interestingly, 
although perfect cloning is forbidden, one can devise approx- 
imate cloning machines, which produce imperfect copies of 
the original state. The concept of a c loning machine was in- 
troduced by lBuzek and Hilleryl dl996h . where the cloning ma- 
chine produced two identical and optimal clones of an arbi- 
trary single q ubit. Their work launched a whole new field o f 
investigation dCerf and Fiuraselj . l2006t IScarani et al. 1 l2005h . 
Cloning machines are intimately related to quantum cryptog- 
raphy (see Sec. lVlb as they usually constitute the optimal at- 
tack against a given protocol, so that finding the best cloning 
machine is crucial to address the security of a quantum cryp- 
tographic protocol dCerf and Grangie 5 l2007h . 

The extension of quantum clonin g to co ntinuous-variable 



systems was fi rst carried out by ICerf e t al. (2000) and 
ILindbladI d2000l) . where a Gaussian cloning machine was 
shown to produce two noisy copies of an arbitrary coherent 
state (where the figure of merit here is the single-clone excess 
noise variance). The input mode, described by the quadratures 
{qin,Pin), IS transformed into two noisy clones ((?i(2),Pi(2)) 



9l(2) = Qin + Nqi(2), Pl(2) Pi'. 



N, 



pl{2), 



(102) 



where Afqi(2) and NpH2) stand for the added noise opera- 
tors on the output mode 1 (2). We may impose {Nqi(2)) = 
(7Vpi(2)) = 0, so that the mean values of the output quadra- 
tures coincide with those of the original state. It is the vari- 
ance of the added noise operators which translates the cloning 
imperfection: a generalized un certainty relation for the adde d 
noise operators can be derived dCerS 120031: ICerf et ali ^wdt) . 



ANyiANp2 



> 1, 



ANpiANq2 



> 1, 



(103) 



which is saturated (i.e., lower bounded) by this cloning ma- 
chine. The above inequalities clearly imply that it is im- 
possible to have two clones with simultaneously vanishing 
noise in the two canonically conjugate quadratures. This can 
be straightforwardly linked to the impossibility of simulta- 
neously measuring perfectly the two canonically conjugate 
quadratures of the input mode: if we measure q on the first 
clone and p on the second clone, the cloning machine actu- 
ally produces the exact amount of noise that is necessary to 
prevent this p rocedure from be ating the optimal (heterodyne) 
measurement dLindbladi 1200(1 . 

The Gaussian cloning machine was firs t derived in the 
quantum circuit language dCerf et al l l2000l) . which may, for 
example, b e useful for the cloning of fight states onto atomic 
ensembles dFiurasek et ali '2004*). However, an optical ver- 
sion was later d eveloped by Braun stein. Cerf et al\ d200ll) and 
lFiurasekld200ll) . which is better suited for our purposes here. 
The cloning machine can be realized with a linear phase- 
insensitive amplifier of intensity gain two, followed by a bal- 
anced beam splitter. The two clones are then found in the two 
output ports of the beam splitter, while an anti-clone is found 
in the idler output of the amplifier The anti-clone is defined 
as an imperfect version of the phase-conjugate \a*) of the in- 
put state \a), where a — {q + ip)/'2, and a* ^ {q — ip)/2. 
The symplectic transformation on the quadrature operators 
S = (91 1 Pi I 92 , P2 , 93 , P3 ) "'^ of the three input modes reads 



x^Cx, C = (Bel)(l® S2) 



(104) 



where B is the symplectic map of a beam splitter with trans- 
mittance r = 1/2 as defined in Eq. d38i l, S2 is the symplectic 
map of a two-mode squeezer with intensity gain cosh'^ r ~ 2 
as defined in Eq. d40l ). and I is a 2 x 2 identity matrix. The 
input mode of the doner is the signal mode of the amplifier 
(mode 2), while the idler mode of the amplifier (mode 3) and 
the second input mode of the beam splitter (mode 1) are both 
prepared in the vacuum state. At the output, modes 1 and 2 
carry the two clones, while mode 3 carries the anti-clone. By 
reordering the three q quadratures before the three p quadra- 
tures, we can express the cloning symplectic map as 



2-1/2 ^ 2-1/2 

c = I -2-1/2 1 2-1/2 
1 21/2 



2-1/2 ^ _2-i/2 
-2-1/2 ^ _2-i/2 

-1 21/2 

(105) 
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The second columns of the q and p blocks immediately imply 
that the two clones are centered on the input state ((72 7^2), 
while the anti-clone is centered on the phase conjugate of the 
input state (52, — P2). We can also check that the covariance 
matrix of the output modes can be expressed as 



Vi - V2 = V,, 



V3 = ZV,„Z + 2I (106) 



where Vj„ is the covariance matrix of the input mode (mode 
2) and again Z = diag(l,— 1). Thus, the two clones suf- 
fer exactly one unit of additional shot-noise, while the anti- 
clone suffers two shot-noise units. This can be expressed in 
terms of the cloning fidelities of Eq. (ISOl l. The fidelity of each 
of the clones is given by = 2/3, regardless of which co- 
herent state is cloned. The anti-clone is noisier, and char- 
acterized by a fidelity of = 1/2. Note that this latter fi- 
delity is precisely that of an optimal joint measurement of the 
two conjugate quadratures (Arthurs and Kellv, Jr., 1965]), so 
that optimal (imperfect) phase conjugation can be classically 
achieved b y heterodyning the state and preparing its phase- 
conjugate dCerf andlblisdiiil2001bl) . 

A variant of this optical doner wa s demonstrated ex- 
perimentally by lAndersen et al\ (l2005b . where the ampli- 
fier was replaced by a feed forward optical scheme which 
only re quires linear optic al components and homodyne de- 
tection (iLam et al. 1 [19971) . A fraction of the signal beam is 
tapped off and measured using heterodyne detection. The 
outcomes of this measurement are then used to apply an 
appropriate displacement to the remaining part of the sig- 
nal beam. This setup demonstrates near optimal quantum 
noise limited performances, and can also be adapt ed to pro- 
duce a phase-conjugate output dJosse et al\. l2006l) . This 1- 
to-2 Gaussian doner can be straightforwardly extended to a 
more general setting, where M identical clones are produced 
from N identical replica of an unknown c oherent state with 
a fidehty F = MN/{MN + M - N) dCerf and Iblisdiii 
120001) . More generally, one can add N' replica of the phase- 
conjugate st ate at the input and produ ce M' = M + N' — N 
anti-clones (ICerf and Iblisdiii l2001al) . In this more elaborate 
scheme, the signal mode carries all inputs and clones, while 
the idler mode carries all phase-conjugate inputs and anti- 
clones. Interestingly, for a fixed total number of inputs N+N' 
the clones have a higher fidelity if A^' > 0, a property which 
holds regardless of M and even survives at the limit of a mea- 
surement M -^00. So the cloning or measurement perfor- 
mances are enhanced by phase-conjugate inputs. For exam- 
ple, the precision of measuring the quadratures of two phase- 
conjugate states \a) \a*) is as high as that achieved when mea- 
suring four identical states \a)^'^ though half of t he mean en- 
ergy is needed, as experimentally demonstrated bv'Ni set et al\ 
( I2OO7I) . Furthermore, the c loning of phase-conjuga te coher- 
ent states was suggested by IChen and Zhana (l2007h and also 
suggested, as well as demonstrated. bv^Sabuncu et al.\ (l2007l) 
using the linear doner of Andersen et al. (2005). 

Gaussian doners have also been theoretically devised in 
an a symmetri c setting, where the clones have different fideli- 
ties (iFiurasekl 12001). The way to achieve asymmetry is to use 
an additional beam splitter that deflects a fraction of the input 
beam before entering the signal mode of the amplifier This 



deflected beam bypasses the amplifier and feeds the vacuum 
input port of the beam splitter that yields the two clones. By 
tuning the transmittance of the beam splitters, one can gen- 
erate the entire family of doners saturating Eq. ( I103l l. This 
idea can also be generalized to define the optimal asymmet- 
ric d oner producing M different clones dFiurasek and Cerfl, 
l2007b . Other research into Gaussian quantum cloning in- 
cludes, the relationship of the no-clo ning limit to the quality of 
continuous-variable teleportation dGrosshans and Grangieii 
l200lb . the optimal cloning of coh erent states with a finite 
distribution dCochrane et al.l 20041) . the cl oning of squeezed 
and thermal states ( Olivares et al.l l2006l) . and the cloning 
of bot h entangled Gau s sian s tates and Gaussian entangle- 
ment (IWeedbrook et al.l l2008l) . Finally, it is worth noting 
that all the Gaussian doners discussed above are optimal if 
the added noise variance is taken as the figure of merit. The 
Gaussian transformation of Eq. dl05b produces clones with 
the minimum noise variance, namely one unit of shot-noise. 
Surprisingly, if the single-clone fidelity is chosen instead as 
the figure of merit, the optimal doner is a non-Gaussian 
doner which slightly outperforms the Gaussian doner (its fi- 
delity is 2.4 % higher) f or the cloning of Gaussian (coherent) 
states dCerf ef a/.lboOSh . 



V. BOSONIC GAUSSIAN CHANNELS 



A central topic in quantum information theory is the study 
of bo sonic channels , or more properly, linea r bosonic chan- 
nels dPemoen et al.l 1 19771: iLindbladi I2OOOI) . In particular, 
Gaussian channels represent the standard model of noise in 
many quantum communication protocols dEisert and Wolfl 
l2007l iHolevo et al.l Il999t iHolevo and Werneii l200lb . Thev 
describe all those communication processes where the interac- 
tion between the bosonic system carrying the information and 
the external decohering environment is governed by a linear 
and/or bilinear Hamiltonian. In the simplest scenario, Gaus- 
sian channels are memoryless, meaning that different bosonic 
systems are affected independently and identically. This is the 
case of the one-mode Gaussian channels, where ea ch mode 
sent through the channel is per turbed in this way dHolevol 
120071: IHolevo and Werneii l200lh . 



This section is structured as follows. In Sec. IV.AI we give 
a general introduction to bosonic channels and, particularly, 
Gaussian channels, together with their main properties. Then, 
in Sec. IV. B I we discuss the specific case of one-mode Gaus- 
sian channels and their recent full classification. In Sees. IV.CI 
and lV.DI we discuss the standard notions of classical and quan- 
tum capacity, respectively, with quantum dense coding and 
entanglement-assisted classical capacity revealed in Sec. lV.EI 
Entanglement distribution and secret key capacities are dis- 
cussed in Sec. lV.FI Finally, in Sec. lV.GI we consider the prob- 
lem of Gaussian channel discrimination and its potential ap- 
plications. 
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A. General formalism 

Let us consider a multimode bosonic system, with arbi- 
trary N modes, whose quantum state is described by an 
arbitrary density operator p e 'D{'H®^). Then, an A^- 
mode bosonic channel is a linear map £ : p £{p) E 
2?(H®^), which must be completely positive and trace- 
preserving (CPT) ( Nielsen an d Chuang, 2000t ). There are sev- 
eral equivalent ways to represent thi s map, one of the most 
useful being the Stinespring dilation (IStinespringill955l) . As 
depicted in Fig. [T] a multimode bosonic channel can be rep- 
resented by a unitary interaction U between the input state p 
and a pure state |$)^ of ancillary Ne modes associated with 
the environment. Then the output of the channel is given by 
tracing out the environment after interaction, i.e.. 



£ip)^TTE [Uip®m {^\e)U^ 



(107) 



An important property of the Stinespring dila tion is its unique- 
ness up to partial isometries (|Paulsenll2002b . As a result, one 
can always choose |$)^ = |0)^, where |0)^ is a multimode 
vacuum state. 
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FIG. 1 Stinespring dilation of a bosonic channel £. The input state p 
interacts unitarily with a pure state | '1') ^ of the environment, which 
can be chosen to be the vacuum. Note that, besides the output £{p), 
there is a complementary output £{p) for the environment. In some 
cases, the two outputs are connected by CPT maps (see text). 



Note that, in the physical representation provided by the 
Stinespring dilation, the environment has an output too. In 
fact, we can consider the complementary bosonic channel 
£ : p ^ £{p) which is defined by tracing out the sys- 
tem after interaction. For particular kinds of bosonic chan- 
nels, the two outputs £{p) and £{p) are connected by CPT 
maps. This happens when the channel is degradable or anti- 
degradable. By definition, we say that a bosonic channel £ is 
degradable if there exists a CPT map V such that V o £ = £ 
(iDevetak and Shoiil2005b . This means that the environmental 
output £{p) can be achieved from the system output £{p) by 
applying another bosonic channel V. By contrast, a bosonic 
channel £ is called anti- degradable when there is a CPT map 
A such that Ao £ = £ dCaruso and Giovannettil l2006l) (see 
Fig.[D. 

The most important bosonic channels are the Gaussian 
channels, defined as those bosonic channels transforming 
Gaussian states into Gaussian states. An arbitrary A^-mode 
Gaussian channel can be represented by a Gaussian dilation. 
This means that the interaction unitary U in Eq. (1107b is Gaus- 
sian and the environmental state 1$)^ is pure Gaussian (or, 
equivalently, the vacuum). Furthermore, we c an choose an 
environmen t composed of Ne < 2A^ modes (ICaruso et al\. 
I2008ll201lh . The action of a A^-mode Gaussian channel over 



an arbitrary Gaussian state /3(x, V) can be easily expressed in 
terms of the first and second sta tistical moments. In fact, we 
have (iHolevo and Werneiil200ll) 



Tx + d , V ^ TVT^ 



N 



(108) 



where d e 



p2JV 



is a displacement vector, while T and 



N = N-^ are 2A^ x 2A^ real matrices, which must satisfy 
the complete positivity condition 



N + ir2 - iTilT^ > 



(109) 



where O is defined in Eq. (|2]i. Note that, for N = and T :— 
S symplectic, the channel corresponds to a Gaussian unitary 
Us,d (see Sec. lII.A.2b . 



B. One-mode Gaussian channels 

The study of one-mode Gaussian channels plays a cen- 
tral role in quantum information theory, representing one 
of the standard models to describe the noisy evolution of 
one-mode bosonic states. Furthermore, these channels rep- 
resent the manifest effect of the most important eavesdrop- 
ping strategy in continuous-variable quantum cryptography, 
known as collective Gaussian attacks, which will be fully dis- 
cussed in Sec. IVI.B.4I One of the central results in the the- 
ory of one-mode Gaussian channels is the Holevo's canon- 
ical classifica tion. This result was originally derived by 
iHolevol (l2007h and then exploited by several authors to study 
the degradability and security properties of these channels 
(ICaruso et ali l2006t iPirandola. Braunstein. and Llovdl I2OO8I: 



iPirandola. Garcfa-Patron. et g/.L 120091) . 

An arbitrary one-mode Gaussian channel Q is fully char- 
acterized by the transformations of Eq. ( 1108b , where now 
d G and T, N are 2x2 real matrices, satisfying 



N = N^>0, detN > (detT- 1) 



(110) 



The latter conditions can be derived by specifying Eq. (1 109b 
to one mode (N = 1). According to iHolevol (|2007|) . the 
mathematical structure of a one-mode Gaussian channel G = 
Q (d, T, N) can be greatly simplified. As depicted in Fig. 13 a), 
every Q can be decomposed as 



g{p) = w [c{Upu^)] 



(111) 



where U and W are Gaussian unitaries, while the map C, 
which is called the canonical form, is a simplified Gaussian 
channel C = C(dc,Tc,Nc) with d^ = and Tc,Nc di- 
agonal. The explicit expressions of Tc and Nc depend on 
three quantities which are preserved by the action of the Gaus- 
sian unitaries. These invariants are the generalized transmis- 
sivity T := detT (ranging from —00 to +00), the rank of 
the channel r := min[rank(T),rank(N)] (with possible val- 
ues r = 0, 1, 2) and the thermal number n, which is a non- 
negative number defined by 



(det N) 



1/2 



for T = 1 



(detN) 1/2 1 



(112) 



211 



2 , for r ^ 1 
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These three invariants {r, r, h} fully characterize the two ma- 
trices Tc and N^, thus identifying a unique canonical form 
C = C(t, r, n). In particular, the first two invariants {r, r} de- 
termine the class of the form. The full classification is shown 
in table U 
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TABLE I The values of {r, r} in the first two columns specify a 
canonical class Ai, A2, Bi, B2,C oi D (third column). Within each 
class, the possible canonical forms are expressed in the fourth col- 
umn, where also the invariant n must be considered. The correspond- 
ing expressions of Tc and Nc are shown in the last two columns, 
where Z := diag(l, —1), I := diag(l, 1) and is the zero matrix. 

Let us discuss the various classes. Class Ai is composed 
by forms which are completely depolarizing channels, i.e., re- 
placing input states with thermal states. Classes A2 and Bi are 
special and involve canonical forms transforming the quadra- 
tures asymmetrically. Class B2 describes the classical-noise 
channels, transforming the quadratures as x ^ ic + ^ where 
^ is Gaussian noise with classical covariance matrix fil. This 
class collapses to the identity channel for h = 0. Class C 
describes canonical forms with transmissivities < r 7^ 1. 
This class is further divided in two subclasses: (7(Loss) for 
< T < 1, and C(Amp) for t > 1. Canonical forms 
in C(Loss) are known as lossy channels, also denoted by 
£(t, n) := C(0 < r < 1,2, n). These are the most important 
ones, representing the basic model to describe communication 
lines such as optical fibers. In a lossy channel, the input sig- 
nals are attenuated and combined with thermal noise, i.e., we 
have ic y/r-k+^/l — rxth, where xth are in a thermal state 
with h photons. Canonical forms in C(Amp) are known as 
amplifying channels, denoted by A{t, n) :~ C{t > 1, 2, n). 
They describe optical processes, such as phase-insensitive am- 
plifiers, where the input signals are amplified with the addition 
of thermal noise, i.e., x — )- ^/T^k + — Ixt^. Finally, class 
D is associated with negative transmissivities. Its forms can 
be seen as complementary outputs of the amplifying channels. 

We can easily construct the Stinespring dilation of al l the 
canonical forms dPirandola. Braunstein. and Llovdil2008h . As 
depicted in Fig. |2tb), an arbitrary form C(r, r, n) can be di- 
lated to a three-mode canonical unitary C/l corresponding to a 
6x6 symplectic matrix L. This unitary transforms the in- 
put state a (mode A) together with an environmental EPR 
state \v) (modes E and e) of suitable noise-variance v [see 
Eq. (l42bl. In particular, the symplectic matrix is determined 
by the class, i.e., L = L(r, r), while the EPR state is deter- 
mined by the thermal number, i.e., v = 2n + 1. Let us ana- 
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FIG. 2 (a) A generic one-mode Gaussian channel Q can be repre- 
sented by a canonical form C up to input and output Gaussian uni- 
taries U and W . (b) An arbitrary canonical form C = C{t, r, n) can 
be dilated to a three-mode canonical unitary [/l which is described 
by a class-dependent symplectic transformation L = L(r, r). This 
unitary evolves the input state a together with an EPR state 
with noise-variance = 2n + 1 and belonging to the environment, 
(c) Apart from class B2, all the other classes can be dilated using 
L(r, r) = M(r, r) © le. This means that only one mode E of the 
EPR state li/) is combined with the input mode A. (d) Tracing out 
mode e, we get a thermal state p{n) on mode E. Thus the canonical 
forms of all the classes but B2 can be represented by a single-mode 
thermal state interacting with the input state via a two-mode sym- 
plectic transformation M. 



lyze L(t, r) for the various classes, starting from B-z- For null 
rank, class B2 collapses to the identity and we simply have 
L(1,0) = I. However, for full rank the symplectic matrix 
L(l, 2) does not have a simple expression ( jHol evo. 2003). If 
we exclude the class B2, the symplectic matrix L can always 
be decomposed as L(r, r) = M(r, r) ® Ig, where M de- 
scribes a two-mode canonical unitary acting on modes A and 
E, while le is just the identity on mode e. As depicted in 
Fig. |2c), this means that only one mode E of the EPR state 
is actually combined with the input mode A. Clearly by 
tracing out the unused EPR mode e, we get a thermal state 
with n photons on mode E, as depicted in Fig. |2jd). Thus 
the canonical forms C(r, r, n) of all the classes but B2 admit 
a physical representation where a single-mode thermal state 
p{n) interacts with the input state via a two-mode symplec- 
tic transformation M(r, r). Despite being simpler than the 
Stinespring dilation, this unitary dilation involves a mixed en- 
vironmental state and, therefore, it is not unique up to partial 
isom etries. The explicit ex pressions of M(t, r) are relatively 
easy dCaruso et all l200"6h . For classes Ai, A2 and Bi, we 
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Then, for classes C(Loss), C(Amp) and D, we have 



M(0 < T < 1,2) = 



M(t > 1,2) = 



M(t < 0,2) = 



(114) 
(115) 

(116) 
(117) 
(118) 



Here it is important to note that Eq. dl 16b is just the beam 
spHtter matrix (cf. Eq. ([38j). This means that the Stine- 
spring dilation of a lossy channel £ ( t, n) i s an entangling 
doner dOrosshans. van Assche. et aZl l2003h . i.e., a beam 
splitter with transmissivity r which combines the input mode 
with one mode of an environmental EPR state Clearly, 
this implies the well-known physical representation for the 
lossy channel where a beam splitter of transmissivity r mixes 
the input state with a single-mode thermal state p{n). A par- 
ticular case of lossy channel is the pure-loss channel £(r, 0) 
which is given by setting n = 0. In this case the Stinespring 
dilation is just a beam splitter mixing the input with the vac- 
uum. 

Finally, let us review the degradability properties of the 
one-mode Gaussian channels. Since these properties are in- 
variant by unitary equivalence, we have that a degradable 
(antidegradable) channel Q corresponds to a degradable (an- 
tidegradable) form C. All the forms Cjr, r, n) with transmis- 
sivity T < 1/2 are antidegradable dCaruso and Giovannettil 
I2OO6I) . This includes all the forms of classes Ai, A2, D and 
part of the forms of class C, i.e., lossy channels C{t, n) with 
T < 1/2. By unitary equivalence, this means that one-mode 
Gaussian channels with transmissivity t < 1/2 are all an- 
tidegradable. For T > 1/2 the degradability properties are not 
so straightforward. However, we know that pure-loss channels 
£(r, 0) with t > 1/2 and ideal amplifying channels A{t, 0) 
are all degradable. 



C. Classical capacity of Gaussian channels 

Shannon proved that sending information through a noisy 
channel can be achieved with vanishing error, in the limit of 
many uses of the channel. He developed an elegant math- 
ematical theory in order to calculate the ultimate limits on 
data transmission rates achievable over a classical communi- 
cation channel N, known as the channel capacity (Shanno^ 
Il948l) . Let us consider two parties, Alice and Bob, which 
are connected by an arbitrary noisy channel M. At the in- 
put, Alice draws letters from a random variable (or alpha- 
bet) A := {a, Pa}, where the letter a occurs with probabil- 
ity Pa- The information content of this variable is expressed 



in terms of bits per letter and quantified by the Shannon en- 
tropy H{A) = — Pa log Pa (it IS Understood that when we 
consider continuous variables, the probabilities are replaced 
by probability densities and sums by integrals.) By draw- 
ing many times, Alice generates a random message oi , 02 , • • • 
which is sent to Bob through the noisy channel. As long as the 
channel is memoryless, i.e., it does not create correlations be- 
tween different letters, Bob's output message can be described 
by drawings from another random variable B {b,pb} cor- 
related to the input one B = Af{A). On average, the number 
of bits per letter which are communicated to Bob is given by 
the mutual information I{A : B) = H{B) - H{B\A), where 
H{B\A) is Shannon entropy of -B co nditioned on the knowl- 
edge of A dCover and Thomas! l2006h . Now, the channel ca- 
pacity C{J\f), expressed in bits per channel use, is given by 
maximizing the mutual information over all of Alice's possi- 
ble inputs 



C(7V) = max /(A 



B) 



(119) 



It is important to note that many communication chan- 
nels, such as wired and wireless telephone channels and satel- 
lite links are currently modeled as classical Gaussian chan- 
nels. Here the input variable A generates a continuous sig- 
nal a with variance P which is transformed to a continuous 
output b = ra + where r is the transmissivity of the 
channel, and ^ is drawn from a Gaussian noise-variable of 
variance V. Shanno n's theory gives the capac ity C{Af) = 
\ log (1 + rPy-i) dCover and Thomasl |2006|) . We remark 
that this result predicts an infinite communication rate through 
a noiseless channel {y — 0). This counterintuitive result is 
due to the lack of limitation to the measurement accuracy in 
classical physics. This is no longer true when we consider the 
actual quantum nature of the physical systems. In fact, if we 
encode classical information in the temporal modes (pulses) 
of the quantized electromagnetic field, then the capacity of the 
identity channel is no longer infinite but depe nds on the input 
energy. As shown by I Yuen and Ozawal d 19931) . the capacity of 
the identity channel I is given by C(X) = g(2fh + 1), where 
.g(-) is given in Eq. d47] i and fh is the mean number of pho- 
tons per pulse. Thus, a quantum mechanical treatment of the 
problem gives a finite solution for finite energy, showing that 
quantum mechanics is mandatory in understanding the ulti- 
mate limits of communication. 

Since information is fundamentally encoded in a physical 
system and quantum mechanics is the most accurate repre- 
sentation of the physical world, it is therefore natural to ask 
what are the ultimate limits set by quantum mechanics to com- 
munication? Since the 1980s several groups started studying 
quantum encoding and detection over optical channels, mod- 
eled a s Gaussian quantum channels dCaves and Drummondi 



elea a s Uaussian quantum cnannels (leaves ana Urummondl 
11994 iHal 1 1994 Ishaoirol Il984t I Yuen and Shaoirol Il980h 
An important milestone was achieved wit h the Holevo- 
Schumacher-Westmoreland (HSW) th eorem dHolevol Il998l; 
ISchumacher and Westmoreland! Il997l) . which laid the basis 
for a quantum generalization of Shannon's communication 
theory. First of all, let us intr oduce the notio ns of quantum 
ensemble and Holevo bound dHolevol Il973b . An arbitrary 
random variable A = {a,pa} can be encoded in a quantum 
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ensemble (or source) A = {pa,Pa}, where each letter a is 
associated with a quantum letter-state pa occurring with prob- 
ability Pa- Since quantum states are generally non-orthogonal, 
a non-trivial question is the following: what is the maximum 
information that we can extract from A using a quantum mea- 
surement? This quantity is called the accessible information 
of the ensemble and is less than or equal to the Holevo bound, 
defined as 

xiA)^S{aA)-J2paS{pa) , (120) 

a 

where S'(-) is the von Neumann entropy and (7a = J^aP^Pa^s 
the average state of the ensemble (for continuous ensembles, 
the previous sums become integrals). Now, the key-result of 
the HSW theorem is that the Holevo bound is asymptotically 
achievable when we consider a large number of extractions 
from the source and a collective quantum measurement. In 
this limit, the Holevo bound x(-4) provides the accessible in- 
formation per letter-state. 

These results can be directly applied to memoryless quan- 
tum channels A4. In this case, the letter-states drawn from 
a source A — {pa,Pa} are transformed identically and inde- 
pendently by the channel, i.e., pai ® pa-2 - ■ ■ ~^ -^{Pai) ® 
M {pa2 ) ■ ■ ■ By performing a collective measurement on the 
output message-state. Bob can extract an average of 7M) 
bits per channel use, where 

X{AM) ^ S[M{aA)]-Y.PaS[M{pa)] ■ (121) 

a 

Thus the Holevo bound x{A,M) gives the optimal communi- 
cation rate which is achievable over the memoryless quantum 
channel for fixed source A. Maximizing this quantity over 
all the sources A we obtain the (single-shot) capacity of the 
channel 

C(i)(X) = maxx(AX) • (122) 

A 

For bosonic systems, where memoryless channels are usu- 
ally one-mode channels, the quantity of Eq. ( I122l i must be 
constrained by restricting the maximization over sources with 
bounded energy Tr((TAri) < fh. 

Note that we have introduced the notation single-shot in 
the definition of Eq. (1122b . This is because we are restrict- 
ing the problem to single-letter sources which input product 
states. In general, we can consider multi-letter sources which 
input states that are (generally) entangled between n uses of 
the channel A^®". Then, we can define the full capacity of 
the channel via the regularization 

C{M)= lim -C^^^X®"). (123) 

n— >oo Ji 

For one-mode bosonic channels, the computation of Eq. ( |123t 
involves the maximization over sources which emit n- 
mode entangled states and satisfying the energy constraint 
Tr((TAn®") < nm. Now an important question to ask is 
if the presence of entanglement can really enhance the rate 
of classical communication. In other words, do we have 



C[M) > C^i^TW)? iHastingsl ( |2009|) proved the existence 
of channels for which this is the case. However, for one-mode 
bosonic Gaussian channels this is still an open question. 

A first step in this direction has been the computation of 
the capacity of a pure-loss channel Cp £(t, 0). By 
exploiting the sub-additi vity of the von Neumann entropy, 
iGiov annetti et al.\ (l2004ah obtained an upper-bo und for C (Cp) 
coinci ding with the lower-bound rep orted by iHolevo et al.\ 
(Il999h and iHolevo and Wernej (l200lh . As a result, a pure- 
loss channel Cp of transmissivity r has classical capacity 
C{Cp) ~ g{Tp + 1 — r), where p 2m + 1 and rli is 
the mean number of photons per input mode. Interestingly, 
one can achieve this capacity by sending coherent states mod- 
ulated with a Gaussian distribution of variance V = p — 1. 
At the detection stage, collective measurements might be nec- 
essary. However, this is not the case in the regime of many 
photons, where heterodyne detection is sufficient to achieve 
the capacity. 

The model of pure-loss channel Cp can be adopted to de- 
scribe broadband communication lines, such as wave guides, 
where the losses are independent from the frequency. For a 
pure-loss channel of this kind which employs a set of fre- 
quencies ojk = kSuj for integer k, one can derive the ca- 
pacity C — S,\/tPT, where r is the transmissivity, T = 
2tt/6uj is the transmission ti me, P is the average transmitted 
power, and £ is a cons tant dGiovannetti et al. 1 l2004ai Eool 
I Yuen and Ozawai Il993b . Another important scenario is free- 
space optical communication. Here, transmitter and receiver 
communicate through circular apertures of areas At and A,. 
which are separated by a distance L. Far-field regime corre- 
sponds to having a single spatial mode, which happens when 
AtArUp' {2ncL)~^ := t(w) -C 1, where c is the speed of light 
and t{uj) is t he transmissivity of the op timal spatial mode with 
frequency w (lYuen and Shapirolll978h . We have a broadband 
far-field regime when we use frequencies up to a critical fre- 
quency ujc, such that t{uJc) ^ 1- In this case, we can compute 
the capacity 

fVo 

C = {uJcT/2ny^) / dx g[{e^'^ - (124) 
Jo 

where j/o is a pa rameter which i s conne c ted w i th the 
energy const r aint (loiovannetti efaZl l2004at iGuhai l2008t 
IShapiro et al\. 120051) . Recently, the computation of this clas- 
sical capacity has been generalized to the presence of op- 
tical refocusing s ystems between transmitter and receiver 
(iLupo ef a/.ll20Ilb . 

1 . Bosonic minimum output entropy conjecture 

Despite a huge research effort in recent years, little progress 
has been achieved in the calculation of the classical ca- 
pacity of other one-mode Gaussian channels. However, 
by usin g Gaussian encodings, we can easily give lower 
bounds dLupo et all |20I ih . For instance, using a coherent 
state encoding at the input of a lossy channel £(t, n), we can 
compute the following lower bound for the capacity 

C{C)>g[Tp + {l-T)u]-g[T+{l-Ty] :^CiC), (125) 
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where v := 2n + 1, fi := 2 m + 1, and m is the mean number 
of photons per input mode jHolevo et a/.LIl999h . It is beheved 
that this lower-bound is tight, i.e., C(£) = C_{C). This con- 
jecture is implied by another conjecture, known as the bosonic 
minimum output entropy conjecture and stating that the min- 
imum entropy at the output of a lossy channel is realized by 
a vacuum state at the input, i.e., S'[£(|0) (0|)] < S[C{p)] for 
every p. It seems extremely reasonable to assume that sending 
nothing through the channel is the best way of minimizing the 
noise (entropy) at its output. However, such a simple state- 
ment is still today without a proof. Using Lagrangian min- 
imization it has been possible to p rove that vacuum is a lo- 
cal minimum of th e output entrop y dOiovannetti et all 2004bl: 



cal mmimum or th e output entrop y fluiovannetti et a;.LUUU4bt 
iLlovd et a/.ll2009l) . In the work of lGiovannetti et al\ ( l2004bh a 
simulated annealing optimization suggested that outputs pro- 
duced by a vacuum input majorize all the other outputs, and 
therefore have smaller entropy. Other studies showed that the 
output Renyi entropy of integer orde rs > 2 is minimized by 
the vacuum input and is also add i tive ([Giovan netti and Lloyd, 
|2004 lOiovannetti. Llovd. et ai[ |2004|k Unfortunately, the 
von Neumann entropy is the Renyi entropy of order 1, which 
is therefore not covered by these results. By restricting the 
input states to Gaussian states it was proven that vacuum 
gives the minima l output entropy dGiovannetti et all l2004bl: 
iHiroshimaL l2006t ISerafini. Eisert. and WolA l2005h : unfortu- 
nately this does not preclude the possibility of having non- 
Gaussian input states performing better. Finally, alterna- 
tive approaches to the problem were also prop osed, such a s 
proving the entropy photon-number inequality (lGuhaLl2008h . 
which is a quantum version of the c lassical entropy power in- 
equality dCover and Thomasll2006l) . 



D. Quantum capacity of Gaussian channels 

Quantum channels can be used to transfer not just classi- 
cal information but also quantum information. In the typi- 
cal quantum communication scenario, Alice aims to transmit 
quantum states to Bob through a memoryless quantum chan- 
nel . The quantum capacity Q {Jv[ ) of the channel gives the 
number of qubits per channel use that can be reliabl y trans- 
mitted. As shown bv lSchumacher and Nielseiil (Il996l) . a cru- 
cial role in the definition of the quantum capacity is played 
by the coherent information J{M., pa), which is a function of 
Alice's input pA and the channel M.. In order to define this 
quantity, let us introduce a mirror system R and the purifica- 
tion <^uA = \^) {^\ra °f 'ir\^\A state pA = Tr/j ($7^^), as 
shown in Fig. [3] Then, the coherent information is defined by 
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FIG. 3 Alice's input state pA is transformed into Bob's output state 
ps by a generic memoryless channel M. The input state pA can be 
purified by introducing an additional mirror system R. 



where puB '■= {1r <E) Ai){^RA), 1-b. being the identity chan- 
nel on the mirror system R. The (single-shot) quantum capac- 
ity is computed by maximizing over all the input states 



Q 



(1) 



{M) = max J(A^, p^). 

PA 



(127) 



Since this quari tity is 
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definition of quantum capacity is given by the regularization 
dPevetaL .2005: .Lloyd. . 1 997: .Shor. .2002) 



Q{M)^ lim -maxJ(7W®",/5A") , 

n— >oo n pa^ 



(128) 



where the input state pA^^ is generally entangled over n uses 
of the channel A^*^". It is important to note that the coher- 
ent information computed over bosonic channels is finite even 
for infinite input energy. As a result the quantum capacity of 
bosonic channels is still defined as in Eq. ( 11281 ) without the 
need of energy constraints. Another important consideration 
regards degradable and an tidegradable channels. As shown by 
iDevetak and Shod d2005b . degradable channels have additive 
quantum capacity, i.e., Q{M.) = Q^^-*(A^). By contrast, an- 
tidegradable channels have null quantum capacity Q{M) ~ 
dCaruso and Giovannettill2006l) . 

Let us consider the specific case of one-mode Gaussian 
channels. In this case a lower bound can be computed 
by restricting the quantum capacity to a single use of the 
channel and pure Gaussian states. Thus, for an arbitrary 
one-mode Gaussian channel Q with transmissivity r # 1, 
we can write the lower-boun d ( Holevo and Wernen , 1200 it 



iPirandola. Garcfa-Patron. et al 1 120091) 



O,log 



-9M 



J{MrPA)^S{pB)-S{pRB) 



(126) 



Q{Q) > Q^i'^H^) =max.^_,__ 

' (129) 

where v := 2n + 1 and n is the thermal number of the chan- 
nel. Clearly this formula applies to all the canonical forms 
of classes Ai, A2, C and D. There are remarkable cases 
where the bound in Eq. ( I129l l is tight. This happens when the 
on e-mode Gaussian channel is degradable. The proof given 
m dWolf et all l2007b combines the additivity for degradable 
channels Q{G) = Q^^^iG) wi th the extremality of Gaussian 
states Q'^^HG) = Q'^^'<^HG) dWolf ef g/.l I2OO6I) . Important 
examples of degradable one-mode Gaussian channels are the 
ideal amplifying channels A{t, 0) and the pure-loss channels 
£(r, 0) with transmissivity r > 1/2. Another case, where the 
previous bound is tight, regards all the one-mode Gaussian 
channels with transmissivity t < 1/2. These channels are 
in fact antidegradable and we have Q{G) = Q'-^'^H^) ^ 0- 
Note that we can also compute a lower bound to the quan- 
tum capacity for t = 1 in the case of a canonical form 
B2- T his is achieved by using continuous- variable stabiUzer 
codes dHarrington and Preskill , l200ll) . 
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E. Quantum dense coding and entanglement-assisted 
ciassicai capacity 

The classical capacity of a quantum channel can be in- 
creased if Alice and Bob share an entangled state. This effect 
is known as quantum dense coding. The analysis that reaches 
this conclusion ignores the cost of distributing the entangle- 
ment. The rationale for doing this is that the entanglement 
does not carry any infor mation per se. Originally intr oduced 
in the context of qubits (iBennett and Wiesneil 1 1992b. dense 
coding was later extended to continuous variables ( BanL 1999t 
iBraunstein and Kimblel Il999t iRalph and Hu ntington' '2002h. 
with a series of experiments in both settings (iLi et a/.»,i200: 



iMattle et a/.lll996HMizuno et a/.ll2005l|Pereira et a/.lboOOl) . 

The basic setup in continuous variables considers the dis- 
tribution of information over an identity channel I by means 
of a single bosonic mode. Here Bob possesses an EPR state 
of variance V. This state can be generated by combining a 
pair of single-mode squeezed states with orthogonal squeez- 
ings into a balanced beam splitter. In particular, the squeezed 
quadratures must have variance Vgq — V ~ y/V^ — 1. Bob 
sends one mode of the EPR state to Alice, while keeping the 
other mode. To transmit classical information, Alice modu- 
lates both quadratures and sends the mode back to Bob, with 
mean number of photons equal to rh. To retrieve information. 
Bob detects both received and kept modes by using a Bell 
measurement with d etector efficiency 77 £ [O^ll- T he achiev- 
able rate is given by (iRalph and Huntington! 120021) 



Rdc{^) = log 



1 



7?(4m - V,g - 1/Vsg + 2) 



(130) 



This rate can exceed the classical capacity of the identity chan- 
nel C{I) at the same fixed average photon number fh for a 
considerable range of values of Vsq and rj. 

The advantages of quantum dense coding can be extended 
to an arbitrary memory less channel Ai. This leads to the 
notion of entanglement-assisted classical capacity Ce{.M), 
which is defined as the maximum asymptotic rate of reliable 
bit transmission over a channel Ai assuming t he help of un- 
limited pre-shared entanglement. As shown by iBennett et al.\ 
(l2002h this is equal to 



Ce{M) = maxI{M, pa), 

PA 



(131) 



where I{Ai, pa) ~ S{pa) + J{Ai, pa) is the quantum mu- 
tual information associated with the channel Ai and the input 
state PA (J is the coherent information). For one-mode Gaus- 
sian channels, the capacity Ce must be computed under the 
energy constraint Tr{pAn) < rh. In particular, for a pure-loss 
channel Cp = £(t, 0), we have (Holevo and Werner, 2001) 

Ce{Cp) = + g{Tp + 1 - r) - .g(A_) - .g(A+), (132) 

where p = 2m + 1 and X± = D ± m(l — t), with 

D = {[1 + m(T + - 4T77i(m + l)}^/^ . (133) 

This capacity is achieved by a Gaussian state. For t 1 we 
have the identity channel and we get Ce{I) = 2g{p), which 
is twice its classical capacity C{I). 



F. Entanglement distribution and secret-key capacities 

Other important tasks that can be achieved in quantum in- 
formation are the distribution of entanglement and secret keys 
over quantum noisy channels. Given a memoryless channel 
Ad, its entanglement distribution capacity E{Ai) quantifies 
the number of entanglement-bits whic h are dis t ribute d per 
use of the channel. As shown by Barnum et al\ (I2OOOI) . this 
quantity coincides with the quantum capacity, i.e., E{A4) = 
Q{Ai). Then, the secret-key capacity K{A4) of the chan- 
nel provides the number of secure bits w hich are distributed 
per use of the channel jPevetaki l2005b . Since secret bits 
can be extracted from entanglement bits, we generally have 
K{Af) > E{Ai). Using classical communication, Alice 
and Bob can improve all these capacities. However, they 
need feedback classical communication, since the capacities 
assisted by forward classical communication, i.e., K^{A4), 
[Ad ) and [Ai ), coincide with the correspondin g M«a5- 
^/^fe^ capacities, Kj Ai), E{Ai) and Q{Ai) (.Barnum et al.l 
l2000HDeveta"5l2005l) . 

Unfortunately, the study of feedback-assisted capacities is 
a very difficult task. Alternatively, we can introduce simpler 
capacities, called reverse capacities, defined by the maximiza- 
tion over protocols which are assisted by a single feedback 
classical communication (known as reverse protocols). A re- 
verse protocol can be explained considering the purified sce- 
nario of Fig. |3] Alice sends to Bob a large number of A modes 
while keeping the R modes. Then Bob applies a quantum op- 
eration over all the output B modes and communicates a clas- 
sical variable to Alice (single final classical communication). 
Exploiting this information, Alice applies a conditional quan- 
tum operation on all the R modes. Thus we have the reverse 
{<) entanglement distribution capacity E^{A4) and the re- 
verse secret-key capacity (Ai), which clearly must satisfy 
K^{A4) > E^{Ai). Interestingly, these capacities can be 
lower bounded by a quantity which is very ea sy to compute. 
In fact, as shown bv lGarcfa-Patron et a/.l(l2009b . we can define 
the reverse coherent information 



MM,pa) = Sipii)~S{pRB) 



(134) 



This quantity differs from the coherent information J {Ai, pa) 
by the replacement S{pb) S{pr) = S{pa)- For this 
reason, we can have Ju{A4, pa) > J{A4,pa) for channels 
which decrease entropy, i.e., S{pa) > S{pb)- Optimiz- 
ing the reverse coherent information over all the inputs, we 
can define the (one-shot) reverse coherent information capac- 
ity E^j^\A4) and the corresponding regularization Efj{A4). 
Interestingly, this quantity turns out to be additive for all 
channels, so that we simply have Er{M) = E^jl\Ai). 
Now the capacity Eii{^4) provides a lower bound for the 
reverse capacities, i.e., K^{M) > E^{M) > Eu{M). 
Th e expression of E^jAi) can be very simple. As shown 
by iPirandola. Garcfa-Patron. et al\ ( l2009l) . an arbitrary one- 
mode Gaussian channel Q with transmission r 7^ 1 has 
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where v := 2h + I and h is the thermal number of the chan- 
nel. Note that Eji{Q) can be positive for r < 1/2, where the 
channel is antidegradable and, therefore, E{Q) = Q{Q) = 0. 
Thus, despite the fact that the unassisted (forward-assisted) 
capacities are zero, the use of a single feedback classical com- 
munication is sufficient to distribute entanglement (E^{Q) > 
0) and secret keys {K^{Q) > 0). In cryptographic terms, 
antidegradibility means that an eavesdropper is able to recon- 
struct the output state of Bob. Despite this, Alice and Bob are 
still able to extract a secret key from their shared correlations 
by using a reverse secret-key protocol. This is a remarkable 
feature of reverse reconciliation, further discussed in Chap- 
terlYl] 



G. Gaussian channel discrimination and applications 

The discrimination of quantum channels represent s one 
of the basic problems in quantum information theory ("Acfn, 
2001 - .Childs et al. 2 000; C hiribella et al ., 2008; D uan et al. 
20091 



Harrow et all l2010i iHavashil 120091: llnvernizzi et al 



201 1[ ISacchil l2005UWang and Yingri2006l) . Here we discuss 
the problem of distinguishing between two Gaussian chan- 
nels. Suppose that we have a black box which implements 
one of two possible (one-mode) Gaussian channels, Qq or Qi, 
with the same probability, and we want to find out which one 
it is. In other words, the box contains an unknown Gaussian 
channel Qu encoding a logical bit u = 0,1 and we want to 
retrieve the value of this bit. The basic approach involves 
probing the box with a one-mode quantum state p and de- 
tecting the corresponding output au := Gu{p) by means of a 
quantum measurement. However, this approach can be read- 
ily generalized. In fact, we can consider multiple access to the 
box by inputting M signal modes. Then, we can also consider 
additional L idler modes, which are not processed by the box 
but are directly sent to the output measurement, as shown in 
Fig. m Thus, for a given state p of the input M + L modes, 
we have two possible output states, ctq and ai, described by 
the dichotomic state (7„ (5®^ ® I^^){p), where G^'^^ 
is applied to the signals and the identity I®^ to the idlers. 
This output is detected by a multimode quantum measure- 
ment whose outcome estimates the encoded bit. Now, since 
(To and (Ti are generally non-orthogonal, the bit is decoded 
up to an error probability Perr- Thus, the main goal of the 
problem is the minimization of Perr, which must be done on 
both input and output. For fixed input state p, the optimal de- 
tection of the output is already known: this is the Helstrom's 
dichotomic POVM discussed in Sec. IIII.AI However, we do 
not know which state is optimal at the input. More precisely, 
we do not know the optimal input state when we constrain the 
signal energy irradiated over the box. Here there are two kinds 
of constraints that we can actually consider The first one is 
a global energy constraint, where we restrict the mean total 
number of photons nitot irradiated over the box. In this case 
the minimum value of perr can be non-zero. The second one is 
a local energy constraint, where we restrict the mean number 
of photons TO per signal mode. In this case, the value of p^rr 
generally goes to zero for M +oo and the problem is to 



achieve the most rapid decaying behavior In both cases find- 
ing the optimal input state for fixed energy is an open problem. 

However, we can try to answer related questions: for fixed 
energy, does entanglement help? Or more generally: do we 
need non-classical states for minimizing Perr? By definition 
a state is called classical (non-classical) when it can (cannot) 
be written as a probabilistic mixture of coherent states, i.e., 
p = J daP{a) \a) {a\, where ja) = \ai) ® • • • (g) Iul+m) 
and P{a) is a probability density function. Classical states are 
always separable and represent the standard sources in today's 
optical applications. By contrast, non-classical states (such as 
number states, squeezed and entangled states) are only gen- 
erated in quantum optics labs. Thus, we can formulate the 
following question: for fixed signal energy {mtot or rfi) and 
optimal output detection, can we find a non-classical state 
which outperforms any classical state in the discrimination of 
two Gaussian channels? This b asic question has motivated 
several theoretical inv estigations ( Pirandola', '201 1"; 'Tan et ali 
l2008llUsha Devi and Raiagopal. 2009; Yuen and Nair„ .20091 
In particular, it has been answered in two interesting scenar- 
ios, with non-trivial implications in quantum technology. 
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FIG. 4 Gaussian channel discrimination. The input state p describes 
M signal modes and L idler modes. Only the signals probe the black 
box which contains one of two possible (one-mode) Gaussian chan- 
nels C/o or Qi (encoding a bit u). At the output, signals and idlers are 
described by a dichotomic quantum state (t„ whose detection gives 
an estimate of the bit. 



Th e first scenario is know n as quantum illu mination (iLlovdl 
|2008|) with Gaussian states jTan ef a/.l [20081) . Here the Gaus- 
sian channel discrimination Qq ^ Qi is related with the prob- 
lem of sensing the presence of a low-reflectivity object in a 
bright thermal-noise environment. In this case, the black box 
of Fig.|4]represents a target region from where the signals are 
reflected back to the detector If the object is absent (bit-value 
u = 0) we have a completely depolarizing channel C(G, 0, n) 
which replaces each signal mode with an environmental mode 
in a thermal state with n 1 photons. By contrast, if the 
object is present (bit-value u ~ 1), we have a lossy channel 
n') with high loss k <C 1 and high thermal number n' := 
n/(l — k) 1. These channels are entanglement-breaking, 
i.e., no entanglement survives at the output. Now, assum- 
ing very few photons per signal mode ifi <C 1 (local con- 
straint), we ask if a non-classical state is able to outperform 
any classical state. To this goal, we construct an EPR trans- 
mitter composed of M signals and M idlers in a tensor prod- 
uct of EPR states, i.e., $j\f := pii{r) (E) ■ ■ ■ (E) pMAiir), where 
Pij{r) is an EPR state of squeezing r which entangles signal 
mode i and idler mode j. The corresponding error probability 
Perr — Pepr{M) Can be computed using the Gaussian for- 
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mula of the quantum Chernoff bound (see Sec. lIII.A.2.al ). For 
large M, we derive pepr(^'^) — exp{—MKfh/n)/2, which 
decays to zero more rapidly than the error probability of any 
classical state with M signals and arbitrary L idlers. In partic- 
ular, if we restrict the classical states to coherent states, then 
we have an error probability pcoh [M) c± exp(— MKTO/4 fl) / 2 
which is 6 dB worse than pepr(M) dTan et ali |2008|) . In- 
terestingly, the quantum illumination advantage accrues de- 
spite the fact that no entanglement survives at the output. In 
fact, even if the output signal-idler correlations are within the 
classical bounds, there is no classical input state that can pro- 
duce a close approximation to this output state. Further stud- 
ies on quantum illuminat ion of targets have been pursu ed by 
IShapiro and Llovdl (l2009l) and lGuha and ErkmenI (l2009l) . 

The second scenario regards the use of non-classical trans- 
mitters to read data from classical digital memories, such as 
optical d isks (CDs and D VDs). This is known as quantum 
reading dPirandolal |20I l[) . Here the discrimination of Gaus- 
sian channels is associated with the retrieval of information 
from a memory cell, modeled as a medium with two possible 
reflectivities. This cell is equivalent to the black box of Fig. |4] 
where the bit u = 0, 1 specifies two lossy channels, £(ko, n) 
and £(ki, fi), with the same thermal number n but different 
losses 7^ Ki. For optical disks, we can consider low noise 
(n <C 1) and ki close to 1. In these conditions, and irradi- 
ating relatively few photons over the cell ratot — 10 (global 
constraint), we can find an EPR transmitter $ms with small 
A/', which is able to out perform any class ical state with any 
M and L. As shown bv iPirandolal (1201 ll) . the difference in 
the readout of information can be surprising (up to one bit per 
cell), with non-trivial implications for the technology of data 
storage. Follow up studies on the quantum reading of memo- 
ries have been pursued by various authors (iBisio et al\. I2OIII: 
lHirotaLl201 ll:lNai3.l201 itlPirandola et a/.Ll20I ih . 



VI. QUANTUM CRYPTOGRAPHY USING CONTINUOUS 
VARIABLES 

Cr yptography is the theo ry and practice of hiding informa- 
tion ( Menezes et a/.l[l997h . The development of the informa- 
tion age and telecommunications in the last century has made 
secure communication a must. In the 1970s, public-key cryp- 
tography was developed and deals with the tremendous de- 
mand for encrypted data in finance, commerce and govern- 
ment affairs. Public-key cryptography is based on the concept 
of one-way functions, i.e., functions which are easy to com- 
pute but extremely hard to invert. As an example, most of the 
current internet transactions are secured by the RSA proto- 
col, which is based on th e difficulty of factorizing large num- 
bers jRivest et a/.l Il978b . Unfortunately, its security is not 
unconditional, being based on the assumption that no efficient 
factorization algorithm is known for classical computers. Fur- 
thermore, if quantum computers were avai lable today, RSA 
could be easily broken by Shor's algorithm (IShori[l997l) . 

Ideally, it would be desirable to have a complete ly secure 
way o f communicating, i.e., unconditional security. IShannonI 
(Il949h proved that this is indeed possible using the one-time 



pad jVernamll 19261) . Here two parties, Alice and Bob, share a 
pre-established secret key unknown to a potential eavesdrop- 
per. Eve. In this technique, Alice encodes her message by 
applying a modular addition between the plaintext bits and an 
equal amount of random bits from the secret key. Then, Bob 
decodes the message by applying the same modular addition 
between the ciphertext received from Alice and the secret key. 
The main problem of the one-time pad is the secure genera- 
tion and exchange of the secret key, which must be at least 
as long as the message and can only be used once. Distribut- 
ing very long one-time pad keys is inconvenient and usually 
poses a significant security risk. For this reason, public-key 
cryptography is more widely used than the one-time pad. 

Quantum cryptography, or quantum key distribution (QKD) 
as it is more accurately known"*, is a quantum technology al- 
lowing Alice and Bob to generate secret keys that can later 
be used to communicate with theoretically unconditional se- 
curity. This is used in conjunction with the one-time pad 
or another sy mmetric cryptogr aphic protocol such as pretty 
good privacy (ISchneieri 1995b . The unconditional security 
of QKD is guarantee d by the laws of quantum mechan- 
ics ( Gisin ef all |2002|) and, more precisely, the no-cloning 
theorem (cf. Sec. IV.Eb . which can be understood as a man- 
ifestation of the Heisenberg uncertain ty principle. The first 
QKD protocol was the BB84 protocol (IBennett and Brassardl 
Il984l) . Since then QKD has become one of the leading fields 
in quantum information. Despite being a quantum technology, 
QKD is not hard to implement experimentally. In fact, the use 
of telecom components over normal optical fibers is sufficient 
to distribute secret keys with reasonable rates over metropoli- 
tan network areas, as rece ntly demonstrated by the European 
Union's SECOQC project (SECOQC,'2007'). Today QKD can 
be considered as a mature field (.Scarani et a/.i , .2009i) with sev- 
eral start-up companies formed around the world. 

In this section, we review the continuous-variable ver- 
sion of QKD, whose key elements are the modula- 
tion (encoding) of Gaussian states and Gaussian measure- 
ments (decoding), e.g., homodyne and heterodyne detec- 
tion. The first continuous-variable QKD protoc ols were 
based on a discrete modulation of Gaussian states (iHillervl 
l2000t iRalphL Il999at iReidl l2000l) . The first protocol 
based on a continuous (Gaus sian) modulation of Gaus- 
sian states was introduced by ICerf et aJ. 1 (1200 Ih and em- 
ployed squeezed states for the secret encoding. This idea 
was readily extended by Grosshans and Grangieij (|2002|) and 
iGrosshans. van Assche. et al\ (l2003b . with the design and im- 
plementation of the first continuous-variable QKD protocol 
based on the Gaussian modulation of coherent states and ho- 



^ Technically, quantum cryptography refers not only to quantum key dis- 
tribution but also other sec recy tasks such as quant um money, quan- 
tum secret and state sharing jLance et a/.ll2004 l Tvc a nd Sanders. 200: 
quantum bit commitment (albeit with certain constraints I Magnin 
I2OI 
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1201 Ih l and quantum random number gener- 
However, it is not uncommon for quantum 
cryptography and quantum key distribution to be used synonymously in 
the literature. 
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modyne detection. Short ly afterwards, ano t her coherent -state 
protocol was proposed ( Weedbrook et g/l |2004 l2006l) and 
implemented (iLance et al. . 2005 ). known as the no-switching 
protocol, where homodyne detection is replaced by hetero- 
dyne detection. This enables the honest parties to exploit 
both quadratures in the distribution of the secret key. It 
is important to not e that the coherent-state encoding intro- 
duced by Grosshan s and Gran gier (2002) is today at the core 
of the most promising continuous-variable QKD implementa- 
tions, tha nks to the pos sibility of u sing standard t elecom com- 
ponents dFossier et ali 120 09; L odewvck et g/.l l2007i l2005l 
120071: iLodewvck and Grangieitl26o7lK 

In order to reach significant transmission distances, 
i.e., corresponding to more than 3 dB of loss, two 
main techniq ues are commonly use d: rev erse recon- 
ciliation CGrosshans. van Assche. et al. \ l2003l) and post- 
selection dSilberhorn et al. .L l2002h . Furthermore, the introduc- 
tion of new protocols u sing two-way quantum communica- 
tion ( Pirandola. Mancini. et al. , 20081) and discrete modula- 
tion ( Leverrier and Grangiei , 20091 2010bh have shown the 
possibility of further improvements in terms of transmission 
range. Recently, it was shown by Wee dbrook et al.\ d2010l) 
that a secure key could, in principle, be generated over short 
distances at wavelengths considerably longer than optical and 
down into the microwave regime, providing a potential plat- 
form for noise-tolerant short-range QKD. 

The first security proof in con t inuou s-variable QKD 
was given by iGottesman and Preskilll d200lh using squeezed 
states. The proof used techniques from discrete-variable 
quantum error correction and worked for states with squeez- 
ing greater than 2.51 dB. Subsequent proofs for continuous- 
variable QKD followed, including a proof against individ- 
ual at tacks for coherent-state protocols (Grosshans and Cerj . 
|2004 and an unconditional securit y proof which reduced co - 
herent attacks to collective attacks dRenner and Cirad , |2009|) . 
Using the latter result, a large family of QKD protocols 
can b e analyzed against the simpler collective Gaussian at- 
tacks dOarcia- Patron and Cerf , 20061 : ILeverrier and Grangieii 



l2010at iNavascues ef g/.L |2006|) which have been full y 



characterized by Pirandola. Braunstein. and Llovdl d2008l) . 
Mo re recently, finite-siz e effects have begun to be stud- 
ied dLeverrier et a/.ll2blOl) . with the aim of assessing uncondi- 
tional security when only a finite number of quantum systems 
have been exchanged. 

This section is structured as follows. In Sec. IVI.AI we 
present the various continuous-variable QKD protocols using 
Gaussian states. This is followed by an analysis of their se- 
curity in Sec. IVI. Bl and finally, in Sec. IVI.Cl we discuss the 
future directions of the field. 



A. Continuous-variable QKD protocols 

In this section we start by presenting a generic QKD proto- 
col. Then we continue by illustrating the most important fam- 
ilies of continuous-variable QKD protocols based on the use 
of Gaussian states. These protocols are presented as prepare- 
and-measure schemes, where Alice prepares an ensemble of 



signal states using a random number generator. In Sec. IVI.A31 
we also discuss the entanglement-based representation, where 
Alice's preparation is realized by a suitable measurement over 
an entangled source. 



1 . A generic protocol 

Any QKD protocol, be it based on discrete or continuous 
variables, can be divided into two steps: (1) quantum commu- 
nication followed by (2) classical post-processing. During the 
quantum communication, Alice and Bob exchange a signifi- 
cant number of quantum states over a communication chan- 
nel, which is modeled as a quantum channel. In each round, 
Alice encodes a classical random variable a onto a quantum 
system which is sent to Bob. This system is measured by Bob 
at the output of the channel, thus extracting a random vari- 
able 6 which is correlated to Alice's. Repeating this procedure 
many times, Alice and Bob generate two sets of correlated 
data, known as the raw keys. 

Quantum communication is followed by classical post- 
processing where the two raw keys are mapped into a shared 
secret key (i.e., the final key used to encode the secret mes- 
sage). The classic a l post - processing is divided into several 
stage s dGisin et g/.l 120021: Iscarani et aZl 120091: Ivan Assch j, 
l2006h . The first stage is the sifting of the keys where Alice 
and Bob communicate which basis or quadrature they used to 
encode/decode the information, thus discarding incompatible 
data. We then have parameter estimation, where the two par- 
ties compare a randomly chosen subset of their data. This step 
allows them to analyze the channel and upper-bound the infor- 
mation stolen by Eve. Next, we have error correction, where 
the two parties communicate the syndromes of the errors af- 
fecting their data. As a result, Alice's and Bob's raw keys are 
transformed into the same string of bits. Finally, we have pri- 
vacy amplification. During this step, the two parties generate 
a smaller but secret key, reducing Ev e 's kno wledge of the key 
to a negligible amount dvan Asschel l2006l) . The amount of 
data to discard is given by the upper-bound on Eve's informa- 
tion which has been computed during the parameter estima- 
tion stage. 

It is important to note that the classical post-processing 
stages of error correction and privacy amplification involves 
a public channel that Alice and Bob use by means of ei- 
ther one-way or two-way classical communication (the ini- 
tial stages of sifting and parameter estimation always involve 
two-way communication). Two-way classical communication 
is allowed in the postselection protocol which we introduce 
later. When one-way classical communication is used and 
is forward, i.e., from Alice to Bob, we have direct recon- 
ciliation. In this case, Alice's data is the reference which 
must be estimated by Bob (and Eve). By contrast, if one- 
way classical communication is backward, i.e., from Bob 
to Alice, then we have reverse reconciliation, where Bob's 
da ta must be estimated by Alice (and E ve). As discussed 
bv iPirandola. Garcfa-Patron. et al\ (l2009l) . both direct and re- 
verse reconciliation can be in principle realized by using a 
single classical communication. This observation enables a 
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simple definition of the most general protocols in direct and 
reverse reconciliation (direct and reverse protocols). By using 
these protocols we can define the direct and reverse secret- 
key capacities of an arbitrary quantum channel (see Sec. lV.FI ). 
Another important observation is that the public channel used 
for the classical communication must be authenticated. This 
means that Alice and Bob have to identify themselves by us- 
ing a pre-shared secret key (Renner and Wolf, 2005). As a 
result, QKD does not create secret keys out of nothing, but 
rather expands initial secret keys into longer ones. 



2. Coherent-state protocol (homodyne detection) 

A seminal result in QKD using continuous variables 
was the discovery t hat coherent states are sufficien t to dis- 
tribut e secret keys jGrosshans and Grangied 120021: iRalphl 
l2003h . Because coherent states are much easier to gen- 
erate in the lab than any other Gaussian state, this 
result opened the door to experimental demonstrations 
and field implementations. The first Gaussian mod- 
ulated coheren^_state__grotocol_jj^ direct reconcilia- 
tion dGrosshans and Grangieil 20021). followed shortly af- 



ter by reverse reconciliation dGrosshans. van Assche. et aZl 
l2003b . Since then nearly all proposals have used coherent 
states as its substrate. The security of coherent-state protocols 
is based on the fact that coherent states are non-orthogonal (cf. 
Eq. |30] |. which on its own is a sufficient condition for QKD 
(i.e., the no-cloning theorem applies). The quantum commu- 
nication starts by Alice generating two real variables, aq and 
flp, each drawn from a Gaussian distribution of variance Va 
and zero mean. These variables are encoded onto a coherent 
state resulting in a mean of (a^, Op). By imposing Va — V—1, 
we obtain an average output state which is thermal of variance 
V. For each incoming state. Bob draws a random bit u' and 
measures either the q or p quadrature using homodyne detec- 
tion based on the outcome of u'. After repeating these steps 
many times, Alice ends up with a long string of data encoding 
the values {ag,ap) which are correlated with Bob's homodyne 
outcomes b. The post-processing starts by Bob revealing his 
string of random bits u' and Alice keeping as the final string 
of data a the values (a, or Op) matching Bob's quadratures. 



3. No-switching protocol (heterodyne detection) 

In the previous protocols, Alice generates two real random 
variables but in the end only one is ultimately used for the 
key after the sifting stage. Thus, one can modify the protocol 
in order t o use both values for the generation of the key, as 
shown bv IWeedbrook et oZl ( |2004|) . The quantum communi- 
cation part of the protocol is equivalent to the previous pro- 
tocols except for Bob's measurement which is now replaced 
by heterodyne detection, and enables him to measure q and 
p simultaneously (albeit with a noise penalty demanded by 
the uncertainty principle). Since there is no longer the ran- 
dom switching between the two conjugated bases, the random 
number generator at Bob's side is no longer needed. After re- 



peating these steps many times, Alice ends up with two strings 
of data {aq,ap) correlated with Bob's data {bq,bp). Hetero- 
dyne detection allows for a simpler experimental setup, pro- 
ducing higher secret-key rates and can be used in conjunction 
with all known continuous-variable QKD protocols. 



4. Squeezed-state protocols 

The ability to use coherent states was a milestone in 
continuous-variable QKD and is currently, by far, the most 
popular state to use both theoretically and experimentally. 
However, the first protocol based on the Gaussian modulation 
of Gaussian state s with Gaussian measurements was given by 
ICerfefg/.! (l200lh and involved using squeezed states. Here 
Alice generates a random bit u and a real variable a drawn 
from a Gaussian distribution of variance Va and zero mean. 
Subsequently, she generates a squeezed vacuum state and dis- 
places it by an amount a. Before sending the state through the 
quantum channel, Alice applies a random phase of = utt/2. 
This is equivalent to randomly choosing to squeeze and dis- 
place either the g or p quadrature. Averaging the output states 
over the Gaussian distribution gives a thermal state whose 
variance V is the same for u = and u = 1, which prevents 
Eve from extracting information on which quadrature was se- 
lected by Alice. This imposes the constraint Va + ~ V 
on Alice's modulation. Once the state has reached Bob, he 
generates a random bit u' informing him which quadrature 
he should measure. Alice and Bob then publicly reveal their 
strings of random bits keeping only the data which corre- 
sponds to the same measured quadrature. 

Another squeezed s tate protocol was developed by 
iGarcia-Patron and Cerfl (l2009l) where Alice again randomly 
sends displaced squeezed states to Bob. However, this time 
Bob uses heterodyne detection rather than homodyne detec- 
tion, but still disregards either one of his quadrature mea- 
surements, depending on Alice's quadrature choice. This re- 
verse reconciliation protocol can be seen as a noisy version 
of the protocol with squeezed states and homodyne detec- 
tion. Thanks to this addition of noise, the protocol has an 
enhanced robustness versus the noise of the channel which 
can be interpreted as t he continuous-variab le counterpart of 
the effect described by iRenner et al\ (l2005b for qubit-based 
protoco ls. Note that such an effec t can also be seen in the 
work o f|N avascues and Acini (120051) . where the protocol with 
coherent states and homodyne detection has a better perfor- 
mance than the protocol with squeezed states and homodyne 
detection when using direct reconciliation. Further evidence 
that noise can im prove the performance of QKD is provided 
in the work of iPirandola. Garcia-Patron. et al\ (l2009h . 



5. Fully-Gaussian protocols and entanglement-based 
representation 

The previous protocols based on coherent states encoding 
and homodyne detection, together with the no-switching pro- 
tocols and the squeezed states protocols are all based on the 
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Gaussian modulation of Gaussian states followed by Gaus- 
sian measurements. For this reason, we refer to these pro- 
tocols as fully-Gaussian protocols. Because they can be im- 
plemented in direct or reverse reconciliation, they represent a 
family of eight protocols. As we will discuss afterwards, their 
unconditional security can be simply assessed against collec- 
tive Gaussian atta cks. By adoptin g an entangleme nt-based 
repre sentation (.Bennett et al\ . Il99 2; Grosshans, Cer f. et al\ . 
l2003h. these protocol s can be described by a unique scheme 
(IGarcia- Patroni |2007|) where Alice has an EPR state 
with noise variance V and sends one mode A to Bob while 
keeping the other mode A' for herself (see Fig. |5]i. Then, 
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FIG. 5 Entanglement-based representation for the fully-Gaussian 
protocols. Alice has an EPR state sending mode A to Bob 

while keeping mode A' . Alice (Bob) mixes her (his) mode A' (B) 
with a vacuum mode in a beam splitter of transmissivity ta (tb) and 
subsequently homodynes the output quadratures. Depending on the 
value of TA, Alice generates a source of squeezed states (ta = 1) or 
coherent states (ta ~ 1/2). Then, Bob applies homodyne (tb = 1) 
or heterodyne (tb ~ 1/2) detection. 



Alice mixes her mode A' with a vacuum mode C into a 
beam splitter of transmissivity ta, followed by a measure- 
ment of the output quadratures qa and pc- As a result, she 
projects the EPR mode A into a Gaussian state with mean 

d = ilq^A, IpPc) and covariance matrix V = diag(x~^, cc), 
where x = [pV + 1) / {V + pi), pL ~ {1 — ta)/ta and 
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^ta{V^~1) 

TAV + {i~TAy 



^{1-ta){V^~1) 
{1-ta)V + ta 



(136) 



It is easy to check that Alice generates a source of squeezed 
(coherent) states for = 1 (ta = 1/2). Then, Bob applies 
homodyne (tb = 1) or heterodyne (rs = 1/2) detection de- 
pending on which protocol they want to implement. It is im- 
portant to note that the entanglement-based representation is a 
powerful tool to study many other QKD protocols, including 
discrete modulation and two-way protocols. In general, any 
prepare-and-measure protocol admits an entanglement-based 
representation. This is because any ensemble of states on a 
system A can be realized by applyi ng a partial measurem ent 
on a larger bipartite system A + A' dHughston et al. 



6. Postselection 

Originally, it was believed that the range of continuous- 
variable QKD protocols could not exceed the 3 dB loss limit, 
as first encountered by direct reconciliation. Exceeding such 
a limit corresponds to having less than 50% transmission 
which intuitively means that Eve is getting more informa- 



tion on Alice's data than what Bob is. However, two pro- 
posals showed that such a limit can actually be surpassed, 
namely rever se reconciliation (as dis cussed previously) and 
postselection dSilberhorn et all 20021) . The quantum commu- 
nication part of the postselection protocol is equivalent to the 
previously mentioned coherent-state protocols. However, the 
main difference occurs in the classical post-processing stage. 
In the sifting stage, once Bob has revealed which quadra- 
ture he measured, Alice replies with the absolute value of her 
corresponding quadrature (\aq\ or \ap\). Subsequently, Bob, 
depending on Alice's revealed value and the absolute value 
of his measurement outcome |6|, decides, following a pre- 
established rule, whether they should discard or keep parts 
of their data. The main concept is that, every pair of values 
(\a\, \b\) can be associated with a discrete channel and a bi- 
nary protocol, based on the signs of a and b. A theoretical 
secret-key rate i^(|a|, can be calculated for each channel 
(\a\, \b\) from the data obtained during the parameter estima- 
tion stage of the post-processing. The postselection protocol 
discards those channels for which if (|a|, < 0, keeping 
only those channels with a positive contribution. A variant of 
this protocol consists in Bob applying heterodyne instead of 
ho modyne detec t ion, i. e ., a no-switching po stselection proto- 
col dLance et all 120051 : iLorenz et all |2004|) . In such a case, 
Alice and Bob can extract information from both quadra- 
tures thus increasing the secret-key rate. This version of the 
postsel ection protocol has also been experime ntally demon- 
strated dLance et al l l2005HLorenz et adl2006h . 



7. Discrete modulation of Gaussian states 

The very first continuous-variable QKD protocols were 
based on a discrete (and hence, n o n-Gaus s ian) en c oding 
of G aussian states dHillervl l2000l: iRalphl Il999al: iReidl 
I2OOOI) . However, after the discovery of Gaussian modu- 
lated coherent states as a viable resource, the discrete en- 
coding took a back seat with only a small number of pa- 
pers continuing wi t h the i dea (|Heid and Liitkenhausl l2006t 
iNamiki and Hiranol I2003L l2006l) . In recent times though, 
there has been ren ewed interest in the d i screte encodin g 
of coherent state s ( Leverrier and Grangieii l2009l l20I0blla 
ISvchand Leuchsll2009l: IZhao et a/.Ll2009h due to it being ex- 
perimentally easier to implement as well as its higher error 
correction efficiencies which promotes continuous-variable 
QKD over longer di stances. A genera l ized p rotocol using a 
discrete modulation dSvch and Leuchsl l2009l) consists of an 



alphabet of A'' coherent states \ak) = \ae^'^^'^^^) with rela- 
tive phase 2Trk/N, where k encodes the secret key. Bob uses 
either homodyne or heterodyne detection in order to estimate 
k. Such a multi-letter encoding scheme can achieve higher 
key rates under the assumption of a lossy channel. Of the pro- 
posals introduced thus far, the classical post-processing stage 
uses either postselection or reverse reconciliation. The cur- 
rent drawback with discrete modulation Gaussian protocols 
is the infancy of their security analy sis, although promising 
advances have been made rec ently dLeverrier and Grangieii 
l2009ll20I0bHZhao et adl2009l) . 
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8. Two-way quantum communication 



9. Tliermal state QKD 



In standard QKD protocols the quantum communica- 
tion is one-way, i.e., quantum systems are sent from Al- 
ice to Bob. In two-way protocols, this process is bidi- 
rectional, with the systems transformed by Bob and sent 
back t o AUce (.Bostrom and Felbinger 2002, 2008). Re- 
cently, iPirandola. Mancini. et al\ (i2008b introduced this idea 
in continuous-variable QKD, showing how the use of two- 
way quantum communication can increase the robustness to 
noise of the key distribution. As a result, bosonic channels 
which are too noisy for one-way protocols may become se- 
cure for two-way protocols. This "security activation" can 
have non-trivial applications, especially in realistic communi- 
cation lines where the noise is high. For simplicity, we discuss 
only the two-way coherent-state protocol depicted in Fig. |6] 
which is a two-way extension of the no-switching protocol. 
Let Alice prepare a random coherent state |a), whose am- 



Alice 



Eve 




FIG. 6 Two-way coherent-state protocol. Alice sends a random co- 
herent state to Bob, who selects between two configurations, ON or 
OFF. In ON, Bob applies a random displacement D{P). In OFF, 
he heterodynes and prepares another random coherent state I7'). In 
both configurations, the output state is sent back to Alice who per- 
forms heterodyne detection. The figure also displays a two-mode 
attack (discussed later). 



Generally, it is assumed in all the previous continuous- 
variable QKD protocols that Alice's initial states originate 
from encoding classical information onto pure vacuum states. 
However, in practice this is never possible with some level of 
impurity occurring due to experimental imperfections. Ther- 
mal state QKD therefore addresses this issue where the pro- 
tocol is now analyzed with respect to Alic e using noisy co- 
herent states. This was first investigated bv lFilid(l2008h and 
lUsenko and Fiiipl (l2010h who showed that by using reverse 
reconciliation the distance over which QKD was secure, fell 
rapidly as the states be came significantly impur e. Extending 
upon this initial work, IWeedbrook et al. (1201 Ol) showed that 
by using direct reconciliation, and provided that the channel 
transmission r is greater than 50%, the security of quantum 
cryptography is not dependent on the amount of preparation 
noise on Alice's states. This is a counterintuitive result as we 
might naturally expect that as Alice's states become more and 
more thermalized, secure transmission over any finite distance 
would become impossible. Consequently, the best strategy to 
deal with preparation noise is to use a combination of direct 
(t > 0.5) and reverse reconciliation (r < 0.5). This moti- 
vated analysis into secure key generation at different wave- 
lengths and was shown that secure regions exists from the 
optic al and infrared all the wa y down into the microwave re- 
gion (IWeedbrook et a/.ll2010l) . 



B. Security analysis 

The strong est defin i tion o f security in a quantum scenario 
was given by iRenneJ (l2005b . A QKD protocol is said to be 
e-secure if 



D{pabE,0-ab ® Pe) <(- 



(137) 



plitude a is Gaussian modulated. This state is sent to Bob, 
who randomly chooses between two configurations, ON and 
OFF. In ON, Bob applies a random displacement D{I3) with /3 
Gaussian modulated. In OFF, Bob heterodynes the incoming 
state with outcome a' and prepares another random coherent 
state I7'). In both configurations, the state is finally sent back 
to Alice, who performs heterodyne detection with outcome 
7. During sifting. Bob declares the configuration chosen in 
each round. In ON, Alice processes a and 7 to estimate /3. In 
OFF, Alice considers a ~ a' and 7 ~ 7'. During parame- 
ter estimation, Alice and Bob analyze the noise properties of 
the channel, checking for the presence of memory between the 
forward and backward paths. If memory is present, they select 
the OFF configuration only. In this way, they can destroy the 
effect of the memory in the post-processing, by choosing only 
one of the two paths and processing its data in direct or reverse 
reconciliation. In this case the protocol is at least as robust as 
the underlying one-way protocol. By contrast, if memory is 
absent, Alice and Bob can use both the ON and OFF configu- 
rations. In this case, the key distribution is more robust to the 
noise of the channel, with the enhancement provided by the 
use of the ON configuration (see Sec. IVl.B.S.dl for details.) 



where D is the trace distance as defined in Eq. ( |68] ). Here PabE 
is the final joint state of Alice, Bob and Eve and <Jab®PE is the 
ideal secret-key state. Therefore, up to a probability e Alice 
and Bob generate a shared secret key identical to an ideal key 
and with probability 1 — e they abort. In the following we 
present the necessary tools to calculate the secret-key rate K 
for various continuous-variable QKD protocols. 



1 . Main eavesdropping attacl<s 

To prove the unconditional security of a QKD protocol, the 
following assumptions on Eve have to be satisfied: (1) full ac- 
cess to the quantum channel; (2) no computational (classical 
or quantum) limitation; (3) capable of monitoring the pub- 
lic channel, without modifying the messages (authenticated 
channel); (4) no access to Alice's and Bob's setups. Under 
these assumptions, the most powerful attack that Eve can im- 
plement is known as a coherent attack. This consists in Eve 
preparing a global ancillary system and making it interact with 
all the signals sent through the quantum channel, and then 
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storing the output ancillary system into a quantum memory 
Finally, after having listened to all the classical communi- 
cation over the public channel. Eve applies an optimal joint 
measurement on the quantum memory. The security against 
coherent attacks is extremely complex to address. Interest- 
ingly, by usin g the quantum de Finetti th eorem, proven by 
iRennej (120071) for discrete variables and bv lRenner and Cirag 



(120091) for continuous variables, we can prove unconditional 
security in the asymptotic regime by analyzing the simpler 
class of collective attacks. For an arbitrary QKD protocol 
in the entanglement-based representation, if the multimode 
entangled state (shared between Alice and Bob after many 
uses of the channel) is permutationally invariant, then, for the 
quantum de Finetti theorem, this state can be approximated 
(asymptotically) by a mixture of independent and identically 
distributed two-mode states. This corresponds to considering 
the simpler case of a collective attack. 

In a collective attack Eve has a set of independent and 
identically prepared systems (ancillas) each one interacting 
individually with a single signal sent by Alice. In the 
entanglement-based representation, this implies that the out- 
put state of Alice, Bob and Eve is in a tensor product of n 
identical states (/5abE = pfbE^ Eve's ancillas are stored 
in a quantum memory and then, after listening to Alice and 
Bob's classical communication. Eve applies an optimal mea- 
surement on the quantum memory. In the asymptotic regime 
(n oo), the secret-key r ate K can be computed via the for- 
mula dRenner et al. I l2005h : 



K ^ip [I{a:b) - S{x:E)] 



(138) 



where I{a:b) is the mutual information between the variables 
of Alice (a) and Bob (b) and S{x:E) is the Holevo bound 
between Alice's (Bob's) variable x ^ a {x = b) and Eve's 
quantum memory, when direct (reverse) reconciliation is used. 
For more on the mutual information and the Holevo bound see 
Sec. IV. CI The coefficient ip <S [0, 1] models the effect of the 
sifting. For instance, we have (p = 1 for the no-switching 
protocol, while (p = 1/2 for the protocol with coherent states 
and homodyne detection. 



l2008h . In what follows we explain the most important fea- 
tures of finite-size anal ysis in the continuous-variable scenario 
(ILeverrier et al I I2OIOI) . In such a situation, the secret-key rate 
reads 



K 



ipn 



[/3/(a:&) - S,,,iaib):E) - A{n) - D{n)] 



(139) 

where is the total number of signals exchanged; n is the 
numbers of signals used for the establishment of the key 
(A^ — n is used for parameter estimation); (3 is the recon- 
ciliation efficiency (ranging from when no information is 
extracted to 1 for perfect reconciliation); S^p^ {o-{b)-E) is the 
maximal value of Eve's information compatible with the pa- 
rameter estimation data; A{n) is related to the security of 
the privacy amplification and the speed of convergence of the 
smooth min-entropy towards the von Neumann entropy; D{n) 
is the penalty due t o considering col l ective attacks instead 
of coherent attacks dChristandl et all 120091; iRenneii l2007t 
IRenner and CiracL l2009h . The principal finite-size negative 
effect i n discrete-variable OKD is due to the parameter esti- 
mation dCai and Scaranil |2009|) which is expected to be als o 
the case for continuous-variable QKD dLeverrier et a/.ll2010l) . 

Despite the fact that IRenner and Cirad d2009h have shown 
that collective attacks are as powerful as coherent attacks 
in the asymptotic regime, the correction D{n) provided for 
the finite regime leads to a result that could be improved. 
An alternative approach using the natural symme t ries o f 
bosonic channels, was suggested by ILeverrier et al. J 20091) . 
with only partial results obtained so far ( Leverrier and Cerfl, 
l2009h . An ideal solution would be finding a generalization 
of the ILeverrier and Grangie r (2010ai) result by showing that 
collective Gaussian attacks are optimal in the finite regime, 
i.e., D{n) ~ (which is the case for the asymptotic scenario 
as discussed in the next section). The study of finite-size ef- 
fects in continuous-variable QKD is very recent and further 
investigations are needed. 



3. Optimality of collective Gaussian attacks 



2. Finite-size analysis 

Until now we have considered the asymptotic scenario 
where Alice and Bob exchange infinitely many signals. This 
ideal situation is useful when we are interested in comparing 
the optimal performances of different protocols. However, in 
practice the number of signals is always finite. The formalism 
to address this problem was recently developed for discrete- 
variable QKD dCai and Scaranil l2009l IScarani and RenneJ, 



Quantum memory is a device tliat allows the storage and retrieval of quan- 
tum information. It plays a role in many continuous-variable quantum in- 
formation protocols. For more theoretical details and t he s tatus of experi- 
menta l demonstrations, see e.g.. lHammerer ef aHi20ld) and lLvovskv et all 
j2009l). 



The fully-Gaussian protocols, have the most developed se- 
curity proofs due to their high symmetry. As we have dis- 
cussed, IRenner and Cirad d2009h have shown that, assuming 
the permutation symmetry of the classical post-processing, 
collective attacks are as efficient as coherent attacks. There- 
fore, in order to guarantee the security against collective at- 
tacks we need to know what type of collective attack is 
the most dangerous. A crucial step in that direction was 



one based on Gaussian operations ( 


Garcfa-Patron and Cerd 


I2OO6I ILeverrier and Gran2ieill2010al 


Navascues et al. . 2006b. 



This consequently makes the secur ity analysis much eas- 
ier iGarcfa-Patron and Cerfl d2006l) showed that, for an 
entanglement-based QKD protocol characterized by a tripar- 
tite state pabE, i-C-, resulting from Alice's and Bob's measure- 
ments on the pure state of covariance matrix Vab e, 
the secret-key is minimized by the Gaussian state pj^^^ of the 
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same covariance matrix, i.e.. 



KipabE) > KiPabE)- 



(140) 



As a result, collective Gaussian attacks represent the fun- 
damental benchmark to test the asymptotic security of 
continuous-variable QKD protocols based on the Gaussian 
modulation of Gaussian states. 



4. Full characterization of collective Gaussian attacks 

The most general description of a collective Gaussian attack 
is achieved by dilating the most general one-mode Gaussian 
channel into an environment which is controlled by Eve. As 
discussed in Sec. lV.BI an arbitrary one-mode Gaussian chan- 
nel Q is associated with three symplectic invariants: trans- 
missivity t, rank r, and thermal number n. These quanti- 
ties identify a simpler channel, the canonical form C(t, r, n), 
which is equivalent to up to a pair of Gaussian unitaries U 
and W (see Fig. |7J. The canonical form can be dilated into 
a symplectic transformation L(r, r) which mixes the incom- 
ing state a with an EPR state \v) of variance v = 2h + 1 
(see Fig. |7]i. Now if we treat the environment as a large but 
finite box, the dilation is unique up to a unitary U which trans- 
forms the output EPR modes E together with a countable set 
of vacuum modes F (see Fig. |7]i. Thus, for each use of the 
channel. Eve's modes {E, F} are transformed by some U and 
then stored in a quantum memory. This memory is detected 
at the end of the protocol by means of an optimal coherent 
measurement Ai which estimates Alice's data (in direct rec- 
onciliation) or Bob's data (in reverse reconciliation). This is 
the most general description of a collec tive Gaussian attack 
(IPirandola Braunstein. and Llovdll2008b . 
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W — >Bob 



Canonical Form C 



FIG. 7 Construction of a collective Gaussian attack in four steps. 
(1) Any one-mode Gaussian channel Q can be reduced to a canonical 
form C via two Gaussian unitaries U and W. (2) Form C can be 
dilated into a symplectic transformation L mixing the input state a 
with an EPR state (3) In a finite box, the dilation is unique up 
to a unitary U combining the output EPR modes E with a countable 
set of vacuum modes F. (4) After U all of the output is stored in a 
quantum memory that Eve measures at the end of the protocol. 

This scenario can be greatly simplified if we use the Holevo 
bound for Eve's accessible information. For instance, this 
happens when we consider the asymptotic regime, so that 
Eq. ( I138l l holds. In this case, we can ignore the details of 



Ai, the extra unitary U and the extra ancillas F. As a re- 
sult, the attack is simply described by the canonical dilation 
{L(t, r), li/)} and the one-mode Gaussian unitaries {U, W} 
(see solid boxes in Fig. |7]i. As discussed in Ch. II, the 
Gaussian unitaries {[/, W} can be further decomposed in dis- 
placements, rotations and squeezings. By definition, we call 
'canonical' the attacks with U = W — I. These attacks 
are fully described by the canon i cal di lation {L(r, r), ji^)} 
(IPirandola. Braunstein. and Llovdl |2008|) . The most impor- 
tant canonical attack is the (collective) en tangling-cloner at- 
tack (iGrosshans. van Assche. et "al. I I2OO3I) . In this attack, the 
symplectic transformation L represents a beam splitter of 
transmissivity < r < 1 mixing the incoming signal mode 
with one mode only of the EPR state Thus, from the point 
of view of Alice and Bob, we have a lossy channel with trans- 
missivity r and thermal number n = {v — l)/2. This channel 
is the most common, representing the standard description for 
communication lines such as optical fibers. 



5. Secret-key rates 

In this section, we discuss the secret-key rates of the 
continuous-variable QKD protocols given in Sec. lVI.Al These 
rates are derived in the presence of a collective entangling 
doner attack which is the most important collective Gaussian 
attack in the experimental sense. This attack can be identi- 
fied by the parameters of the corresponding lossy channel, i.e., 
transmission r and thermal number n. Equivalently, we can 
consider t and the excess noise x 271,(1 — r)T^^, i.e., 
the noise on Bob's side referred to the input (Alice). These 
parameters are inferred by Alice and Bob during the param- 
eter estimation stage. Given a specific protocol, the corre- 
sponding secret-key rate can be expressed in terms of the two 
channel parameters ?ls K = K{t, x). Furthermore, the equa- 
tion K = defines the security threshold of the protocol, ex- 
pressed in terms of tolerable excess noise x versus the trans- 
missivity of the channel, i.e., x = %(''')■ 

Note that we can derive more general expressions for the 
secret-key rates by considering the most general form of a col- 
lective Gaussian attack (cf. Sec . rVI.B.4l ) . This generaliza tion 
can be found in IPirandola. Brau nstein. and Llovdl (l2008b for 
the no-switching protocol of IWeedbrook et al.\ ( |2004|) . The 
secret-key rates of the other protocols could be generalized as 
well. This generalization involves not only the study of other 
canonical attacks but also the analysis of phase-effects (mix- 
ing of the quadratures) which derive from the Gaussian uni- 
taries U and W. These effects can be taken into account by 
introducing suitable corrections in the expressions of the rates. 
Another possibility is reducing an attack to a canonical attack 
{U — W = l)by means of random transformations in the 
post-processing stage, which sacrifices part of the secret data. 



This sy mmetrization has been recently used bv lLeverrier et al\ 



inissy 
(120091) 



to delete phase-effects from lossy channels. 



a. FuUy-Gaussim protocols 

Here we discuss the secret-key rates for the family of fully- 
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Gaussian protocols. In the entanglement-based description, 
one mode of an EPR state of variance V is sent through the 
lossy channel with transmissivity r and excess noise x- At 
the output of the channel, Alice and Bob's bipartite state is 
Gaussian with covariance matrix 



Vab 



xl zZ 
zZ yl 



(141) 



X = V, y = t{V + x) ™d z = \/t{V'^ — 1). Now the var- 
ious protocols differ for the measurements of both Ahce and 
Bob and the kind of reconciliation used. In order to estimate 
Eq. ( |138b we first calculat e Alice and Bob's mutual informa- 
tion dGarcia-Patrdnl l2007h 



I (a-.b)^- log [{V + x)/{x + >^V-')] 



(142) 



where w — 1, except for the no-switching protocol where 
w = 2; then X = V {X ~ 1) for protocols with coher- 
ent (squeezed) states. The calculation of Eve's information 
is more involved. As an example, we consider the calculation 
of S{b:E) = S{E) — S{E\b) for reverse reconciliation using 
coherent states and homodyne detection. First we use the fact 
that Eve's system E purifies AB, i.e., S{E) = S{AB), where 
S{AB) can be calculated from the symplectic eigenvalues of 
the matrix Yab using Eq. ( |54| ). which are then substituted 
into Eq. ( |46] l. Next, to calculate the term S{E\b) we find the 
symplectic eigenvalues of the covariance matrix VE\b, com- 
puted using Eq. ( |64| ). and then proceed as before. 



b. Postselection 

Determining the secret-key rates for postselection is more 
challenging than either direct or reverse reconciliation. De- 
spite the fact that the postselection protocol involves Gaus- 
sian elements in the quantum communication part, its descrip- 
tion becomes non-Gaussian after the filtering of data. Conse- 
quently, using Eq. ( 11401 ) to upper-bound Eve's information no 
longer applies. Therefore, a subtler analysis has to be car- 
ried out to obtain tighter bounds. Here we present the basic 
security analysis for the postsel ection protocol against col- 
lective entanghng d oner attacks dHeid and Lutkenhausll2007t 
ISvmul et al.i 120071) . When Bob performs homodyne detec- 
tion, the mutual information between Alice and Bob for a 
given pair of variables (|an rp;>li \ b\) is given by Shannon's for- 
mula for a binary channel dShanno ^ 119481) 

/(a : 6) = 1 + pe logPe + {l-Pe) log(l - Pe) ■ (143) 

Here pe is Bob's error in determining the value of Alice's sign 
and is given by 



Pe = {1 + cxp [8V^|a,(p)6|/(l + x)] 



(144) 



Now if Bob performs heterodyne detection, we have to con- 
sider the Shannon formula for two parallel binary cha nnels, 
one per quadrature, and is given by (iLance et al. I I2OO5I) 



Pe = {l+cxp [4V2^|a,(p)6|/(l + x)]} 



Eve's information is calculated using the Holevo bound be- 
tween Eve's system and the information bits used as reference 
for the key (a in direct reconciliation and b in reverse recon- 
ciliation). The key rate for a given pair of values (a, b) reads 



AA' = ip max{/3/(a : b) - S'^'^iE : a;),0}, 



(146) 



where again Lp accounts for the sifting and /? for the recon- 
ciliation efficiency. The postselection is then modeled by the 
maximum function, imposing a zero contribution of the effec- 
tive binary channel when /?/(a : b) — S°''^{E : x) < 0, as 
expected. Finally, the evaluation of the overall secret-key rate 
needs to be calculated numerically and is given by 



K ^ / p{a, b) AK{a, b) da db, 



(145) 



(147) 



where p(a, b) is a joint probability distr ibution. A detailed 
experimental analysis was carried out by ISvmul et al\ ( l2007b 
using postselection with the no-switching protocol. 



c. Discrete modulation of Gaussian states 

One of the technical advantages of continuous-variable 
QKD is that it relies solely on standard high-speed opti- 
cal telecom components. However to date, field imple- 
me ntations have been restricted to short distances (27 km 
by iFossier et al.\ (l2009b ). The main reason is the low effi- 
ciency of the reconciliation stage for protocols using Gaussian 
modulation (iLodewvck et all 20071). This is especi ally true 
at low signal-to-noise ratios ( Leverrier et all l2008l) . which 
is the working regime when distributing secret keys over 
long distances. On the other hand, extremely good rec- 
onciliation protocols exist for discrete modulations, as the 
error correction procedure is greatly simplified. In this 
case, the problem can be mapped onto a binary channel 
with additive noise, for which there exists very good codes , 
such as low-density-parity check codes (iRichardson et all 
I2OOII) . Unfortunately, protocols based on discrete mod- 
ulation, even if using Gaussian states, have non-Gaussian 
entanglement-based representations. As a result, the cal- 
culation of Eve's information can no longer rely on the 
previous optimality proofs fc arcia-Patr on and Cerf, 20061: 
iLeverrier and Grangieiil20"l0a Navascue s et a/.i"2006h . 

However, the proof by Garci'a-Patron and Cerf (|2006|) 
can still be used to provide a (non-tight) Gaussian up- 
per bound on Eve's informa tion. This idea was used by 
ILeverrier and Grangied(l2009l) . where a protocol with four co- 
herent states was shown to outperform Gaussian-modulated 
protocols in the regime of low signal-to-noise ratio. The cru- 
cial point was the observation that the four-state modulation 
well approximates the Gaussian modulation for low modula- 
tion variances. As a result, the Gaussian upper bound can 
still be used, being nearly tight in the studied regime. The 
following year ILeverrier and Grangiej (1201 Obi) proposed an- 
other non-Gaussian (but continuous) modulation protocol able 
to exploit the Gaussian upper bound. In this protocol, Al- 
ice generates points centered on an eight-dimensional sphere 
to decide which ensemble of four successive coherent states 
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are to be sent. Then, Bob uses the no-switching protocol 
(heterodyne detection) to guess the point selected by Alice. 
The secret-key rate reached by this new protocol is higher, by 
nearly an order of magnitude, for realistic parameters, which 
enables the distribution of a secret keys over distances of the 
order of 50 km, even after taking all finite-size effects into 
account. 



d. Two-way quantum communication 

In general, the security analysis of two-way protocols is 
quite involved. For simplicity, here we consider the two-way 
coherent-state protocol of Fig. |6] Using symmetrization ar- 
guments (iRenner, 2005; Renner and Cirac, 2009), one can re- 
duce an arbitrary coherent attack to a two-mode attack, af- 
fecting each round-trip independently. This attack can have a 
residual memory between the two uses of the quantum chan- 
nel. If this memory is present, Alice and Bob use the OFF 
configuration, thus collapsing the protocol to one-way quan- 
tum communication. Correspondingly, the attack is reduced 
to one-mode, i.e., collective, which can be bounded by assum- 
ing a Gaussian interaction (collective Gaussian attack). Thus, 
in OFF, the security threshold is given by the underlying one- 
way protocol (the no switching protocol in this case). The ad- 
vantage occurs when no memory is present, which is the most 
practical situation. In particular, this happens when the orig- 
inal attack is already collective. In this case, Alice and Bob 
can use both the ON and OFF configurations to process their 
data. While the OFF configuration is equivalent to two in- 
stances of one-way protocol (forward and backward), the ON 
configuration is based on a coherent two-way quantum com- 
munication. Let us consider the case of a collective entangling 
doner attack, which results in a one-mode lossy channel with 
transmissivity t and excess noise x- For every r € (0, 1), 
the key distribution is possible whenever the excess noise x 
is below a certain value y specified by the security thres hold 
X = xi"^)- '^s shown bv lPirandola. Mancini. et al.\ (l2008l) . the 
security threshold in ON configuration is higher than the one 
in OFF configuration. For instance, if we consider reverse rec- 
onciliation, we have xon(''') > Xoff(t) for every r € (0, 1). 
As a result, there are lossy channels whose excess noise x is 
intolerable in OFF but still tolerable in ON. Thanks to this se- 
curity activation, the two-way coherent-state protocol is able 
to distribute secret keys in communication lines which are too 
noisy for the corresponding one-way protocol. This result, 
which has been proven for large modulation and many rounds 
(asymptotic regime), is also valid for other Gaussian modula- 
tion protocols, extended to two-way quantum communication 
via the hybrid ON/OFF formulation. 



C. Future directions 

Continuous-variable QKD offers a promising alternative to 
the traditional discrete-variable QKD systems (for a state-of- 
the-art comparison between the various QKD platforms see 
IScarani et al.\ ( l2009l) ). An important next step for continuous- 
variable QKD is to prove unconditional security in a fully 



realistic scenario, for example, by improving the reconcili- 
ation procedures and taking finite-size effects into account. 
This could potentially provide extremely high secret-key rates 
over distances which are comparable to the ones of discrete- 
variable protocols (about 100 km). Thus, additional research 
efforts are focused to extend the range of continuous-variable 
QKD protocols. As opposed to the single-photon detectors 
of discrete-variable QKD, the use of homodyne detection in 
continuous-variable QKD provides an outcome even for the 
vacuum input. Filtering out this vacuum noise is the main 
weakness in the reconciliation procedures. From this point of 
view, postselection is the best choice. Therefore, proving the 
unconditional security of the postselection protocol would be 
of great interest^. Another possibility is the design of new pro- 
tocols which are more robust to excess noise, i.e., with higher 
security thresholds. This would enable the reconciliation pro- 
cedures to work much more efficiently. Such a possibility has 
been already shown by the use of two-way protocols. Thus 
further directions include the full security analysis of proto- 
cols based on multiple quantum communication. 

The further development of continuous-variable quantum 
repeaters is also an important research direction. Quan- 
tum repeaters would allow one to distribute entanglement be- 
tween two end-points of a long communication line, which 
can later be used to extract a secret key. This technique 
combines entanglement distillation, entanglement swapping, 
and the use of quantum memories. Unfortunately, Gaus- 
sian operations cannot distill Gaussian entanglement which 
poses a serious limitation to this approach. However, there 
has been ongoing research effort in the direction of Gaus- 
sian preserving optical e ntanglement distillat i on employ- 
ing non-Gaussian elements ferown e et al. 2003'; Eisert et ah , 
■ 2004; Fiurasek et al... 2003; .Menzies and Korolkova. .2007 : 
balph and Lundll2009l) . 



VII. CONTINUOUS-VARIABLE QUANTUM COMPUTATION 
USING GAUSSIAN CLUSTER STATES 

Quantum co mputation using contin u ous va riables was first 
considered by iLlovd and Braunstei n' ("1999 ^ in the circuit 
model of quantum computing ( Nielsen and Chuand, |2000|) . 
They showed that arbitrary quantum logic gates (i.e., simple 
unitaries) could be created using Hamiltonians that are poly- 
nomial in the quadrature operators q and p of the harmonic 
oscillator Years later, a different but computationally equiv- 
alent model of continuous-variable quantum computation, 
kn own as cluster state quanturn com putation, was develope d 
bv lZhang and BraunsteinI (|2006|) and lMenicucci et ail (|2006|) . 
This measurement-based pr otocol of quantum computation 
was originally developed by iRaussendorf and Briegell ( l200lb 
for discrete variables and forgoes actively implementing quan- 
tum gates. Instead, the computation is achieved via local mea- 



^ At the time of writing a paper by IWalk et al\ i201lh has appeared which 
addresses this issue. 
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surements on a highly entangled multimode state, known as a 
cluster state. In the ideal case, the continuous-variable cluster 
state is created using infinitely squeezed states, but in prac- 
tice, is approximated by a finitely squeezed Gaussian entan- 
gled state. 

These two models of continuous-variable computation 
must be associated with a fault tolerant and error correctable 
system, where at some point the continuous variables are dis- 
cretized. With this in mind, there is a third type of continuous- 
variable quantum computer, known as the Gott e sman- Kitaev- 
Preskill quantum computer dOottesman et al. 1 l200lh . This 
proposal shows how to encode finite-dimensional qubits into 
the infinite-dimensional harmonic oscillator, thus facilitating 
fault tolerance and quantum error correction. In this sec- 
tion, we focus primarily on cluster state quantum computation 
while still using important elements of the Gottesman-Kitaev- 
Preskill computer and the Lloyd-Braunstein model. 

This section is structured as follows. We begin by intro- 
ducing important continuous-variable gates as well as defin- 
ing what constitutes a universal set of gates. In Sec. IVII.BI 
we introduce the notion of one-way quantum computation us- 
ing continuous variables and how one can gain an understand- 
ing of it by considering a teleportation circuit. The important 
tools of graph states and nullifiers follows in Sec. I VII. Cl while 
the realistic case of Gaussian computational errors due to fi- 
nite squeezing is discussed in Sec. IVII.DI The various pro- 
posals for optically implementing Gaussian cluster states are 
revealed in Sec. IVII.EI In Sees. IVII.FI and lVII.GI achieving 
universal quantum computation and quantum error correction 
for continuous variables, are discussed respectively. Two ex- 
amples of algorithms for a continuous-variable quantum com- 
puter are given in Sec. lVII.Hl before ending with future direc- 
tions of the field in Sec lVII.II 



A. Continuous-variable quantum gates 

Before introducing the quantum gates used in continuous- 
variable quantum computation we remind the reader that the 
displacement gate D{a), the beam splitter gate B, and the one 
and two-mode squeezing gates, S and 52, are important Gaus- 
sian gates which have already been introduced in Sec. III.BI 
To begin with, in Gaussian quantum information processing 
there are the Heisenberg-Weyl operators which comprise of 
the position and momentum phase-space displacement opera- 
tors, given respectively as 

X{s) ^ cxp{~isp/2), Z{t) = cxp{itq/2), (148) 

where X{s) gives a shift by an amount s in the q direction 
and Z{t) a momentum shift by an amount t, i.e., in terms of 
the displacement operator D{a) they can be rewritten as X — 
D{s/2) and Z = D{it/2). They are related via X{s)Z{t) = 
e~'**/^Z(t)X(s) and act on the position computational basis 
states \q) as 

X{s)\q)^\q + s), Z{t)\q)^e^'^^'\q). (149) 
and on the momentum basis states \p) as 

X{s) \p) = e-*^f/2 \p) , Z{t) \p) ^\p + t). (150) 



The position and momentum basis states are related via a 
Fourier transform as defined in Eq. (|9]l. The Fourier gate F 
is the Gaussian version of the qubit Hadamard gate and can 
be defined in terms of the annihilation and creation operators 
as well as the quadrature operators 



F = exp(^— Jexp 



"ITT i ■ 








~ cxp 





(151) 



In the phase-space picture, the Fourier gate is a 7r/2 rotation, 
e.g., from one quadrature to the other 

F'fqF = -p, FtpF = q. (152) 

The Fourier gate acts on the displacement gates as follows 

F''Z{t)F ^ X{t), FX{s)F^ = Z{s). (153) 

Finally, the Fourier gate acting on the quadrature eigenstates 
gives 
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(154) 
(155) 



where the subscript is used to remind us whether we are in the 
computational q basis or the conjugate p basis. The phase gate 
P{ri) can be thought of as a type of shearing operation, i.e., a 
combination of rotations and squeezers. It is defined as 



P{ri) = cxp 



(156) 



where e R. The phase gate acts on the X{s) displacement 
gate as 



X{s)P ^ e'-^"' '^X{s)Z{i-is), 



(157) 



while leaving Z unaltered. The phase gate affects the quadra- 
tures as 



P^qP = q, 



P^pP = p + rjq. 



(158) 



The controlled-phase gate, or CPHASE for short, is a two- 
mode Gaussian gate defined as 



exp 



(I) 



qi ® h 



(159) 



The effect of this two-mode gate on the computational basis 
states is given by 



Cz \qi) 192) 



e^'^'^/' ki) 192) 



(160) 



In the Heisenberg picture, the CPHASE gate transforms the 
momentum quadratures according to 



Pi -> Pi + 92, 



P2 



P2 + 91, 



(161) 



while doing nothing to the position quadratures qi qi and 
92 92- The CPHASE gate and the phase gate both get their 
names from the analogous discrete-variable gates and their 
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simila r actions on the Pauli matrices dNielsen and ChuanS, 
120001) . 

Finally, we note the graphical representation of the quan- 
tum gates in the circuit model of computation. The single- 
mode Gaussian gates; Heisenberg-Weyl displacement gates, 
single-mode squeeze gate, Fourier gate and the phase gate are 
given respectively as 



— T]— —{S}— — |"f]— — |"p]— (162) 



While the two-mode Gaussian gates: the CPHASE gate, the 
beam splitter gate and the two-mode squeeze gate, are denoted 
respectively by 



\ \ \ \ (163) 



B 
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1 . Universal set of quantum gates 

A continuous-variable quantum computer is said to be uni- 
versal if it can implement an arbitrary Hamiltonian with ar- 
bitrarily small error. So what are the necessary and suffi- 
cient conditions for a continuous-variable quantum computer 
to be universal? This is given by the Lloyd-Braunstein crite- 
rion dOoyd and BraunsteinL Il999h which tells us which gates 
are needed to generate any unitary transformation to arbitrary 
accuracy. This consists of the two families of gates: 

1. Z{t), P{rj), F and Uq (which is any multimode Gaus- 
sian gate, e.g., Cz or B), V t,r] G M.. This first family 
generates all possible Gaussian operations. 

2. cxpfitq"-^] (for some value of t) which is a non-linear 
transformation of polynomial degree 3 or higher and 
corresponds to a family of non-Gaussian gates. 

Note that if we were restricted to using only Gaussian gates we 
would not be able to synthesize an ar bitrary Hamiltonian. In 
fact, the continuous-variable version (iBartlett ef a/.l l2002h of 
the Gottesman-Knill theorem dGottesman . 1998 ) tells us that 
starting from an initial Gaussian state, Gaussian processing 
(which includes Gaussian measurements and Gaussian opera- 
tions) can be efficiently simulated on a classical computer. 



B. One-way quantum computation using continuous 
variables 



2001 



One-way quantum computation dRaussendorf and Briege 
continuous variables dGu et a/.J 1200' 



usmg 



Menicucci et al. [ \200d IZhang and Braunsteini l2006h al- 
lows one to perform any computational algorithm by 
implementing a sequence of single-mode measurements on a 
specially entangled state known as a cluster state (note that 
we often begin our analysis using a perfectly entangled state 
but move to the more realistic case of a Gaussian cluster 
state as we progress). Here quantum gates are not required, 
as arbitrary Hamiltonians are simulated via measurements 



alone. After each measurement is performed the resulting 
measurement outcome is used to select the basis of the next 
measurement. In general, the order in which measurements 
are made does matter, a property known as adaptiveness. 
However, when implementing only Gaussian gates, this 
condition is relaxed and the order no longer matters, a 
property known as parallelism. The two basic steps of 
continuous-variable cluster state quantum computation can 
be summarized as follows: 

1. Cluster state preparation: All qumodes are initialized 
as highly squeezed vacuum states, approximating mo- 
mentum eigenstates 10)^^. The Cz gate is applied to the 
relevant qumodes in order to create the entangled clus- 
ter state. 

2. Measurements: single-mode measurements are made 
on the relevant qumodes where each result is used to 
select the subsequent measurement basis. 

Here a quantum mode, or qumode for short, is the continuous- 
variable analogue of the discrete-variable qubit and is simply 
a continuous-variable quantum state or mode. Note that, up 
until this point in the review, we have simply referred to such 
states as modes. However in line with the terminology used in 
the current research of continuous-variable cluster states, we 
will refer to such quantum states as qumodes. 



1 . Understanding one-way computation via teleportation 

To get a feel of how measurements allow us to generate 
arbitrary evolutions in cluster state computation, it is helpful 
to look at quantum teleportation from the perspective of the 
quantum circuit model. The quantum circuit for the gate tele- 
portation of a si ngle-mode continuous- variable quantum state 
I?/)) is given by dMenicucci et a/.ll2006l) 



|0), 



p ~ mi 



X{mi)F\'iP) 



(164) 



The above circuit can be understood in the following way. 
The input states consist of the arbitrary state j'i/') that we 
wish to teleport and a momentum eigenstate |0)p (note that 
we will begin by considering the unphysical case of perfectly 
squeezed vacuum states with the realistic case of Gaussian 
squeezed states discussed later). They are entangled using 
a Cz gate. A p quadrature measurement is performed re- 
sulting in the outcome mi. The state \ip) is thus teleported 
from the top quantum wire to the bottom wire and can be 
fully restored by applying the corrections F'^X'^{mi) to the 
output state. We will now go through the above circuit in 
more detail. First, the two initial input states can be writ- 
ten as IV') |0)p. Expanding them into the position basis gives 



1^) |0), 



(2\/7r) ^/ dqidq2i(j{qi) \qi) \q2) where 



/ dqi^/j{qi) \qi) and 



(20i^) ^Jdq2\q2)- Applying 
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the CPHASE gate leads to 
1 



Cz 1^) |0), 



d<Zid<z2V'('?i)e''^«^/'|gi)k2) 



(165) 



After measuring p of the first mode, using the projector 
|mi) (wilp, and obtaining the result mi we get 



^ J dqidq2'ip{qi)e 



igi (g2-mi)/2 



q2) 



where we used (toi \qi) = {2y/Tr)~^exp{—iqi'mi/2). The 
above state can be rewritten as: \t/j') ~ X{mi)F\^). As 
mentioned before applying the corrections gives back the ini- 
tial state: F^'X^mi) |V'') = 

Having considered the teleportation of an arbitrary state, we 
are now i n a position to consider the teleportation of a quan- 
tum gate dBartlett and Munro, 2003), which is at the heart of 
the measurement-based model of computation. This requires 
only a slight alteration to the previous circuit as we will be 
considering teleporting gates that are diagonal in the computa- 
tional basis and thus commute through the CPHASE gate. For 
example, the circuit below teleports the state = U 
where U ~ cxp[i/(g)] is a gate diagonal in the computational 
basis 



UH') 



|0>p 



— p 



mi 



(166) 



X{mi)FU\ 



The above circuit is equivalent to the circuit below, where U 
can be absorbed into the measurement process 



|0)p 



U'^ pU ~ mi 



X{mi)FU\ 



(167) 



The above circuit forms the basis for our understanding of 
measurement-based quantum computation. Let us stop for a 
moment to consider why this is. Circuit ( 11661 ) is the typical 
quantum circuit where an algorithm (in this case gate telepor- 
tation) is achieved by first implementing a quantum gate U 
onto a quantum state j'i/'). However, circuit ( |167t shows us 
that we no longer need to explicitly implement the quantum 
gate but we can simulate the effect of the gate using only mea- 
surements in a new basis. This effect is the building block of 
cluster state computation where we can concatenate a number 
of these circuits to form a larger cluster state. 



the set of universal Hamiltonians g, , cf' using only measure- 
ments. We can forget about the two-mode Gaussian gate Uq 
from the set as we have already used it in creating the cluster 
via the Cz gate. We also use the Hamiltonian cf, rather than 
any other higher order polynomial, because we know how to 
optically implement it (more on this in Sec. lVII.Fl i. This cor- 
responds to the following three transformations 



U]p Uj=p + tq 



(168) 



for i ~ 1,2,3 and where the gates diagonal in the computa- 
tional basis are conveniently written as Uj = cxp[{it/2j)q^]. 
Notice that Ui corresponds to the Heisenberg-Weyl displace- 
ment operator Z{t), U2 is the phase gate P{t) and U3 is known 
as the cubic phase gate, denoted as V{t). So how are the above 
transformations optically implemented? Well, the first one is 
achieved by simply measuring p and adding t to the measure- 
ment result. The second one is a homodyne measurement in 
a rotated quadrature basis: {p cosO — q sm9)/cos9. However, 
the cubic Hamiltonian is a little more difficult to implement 
than the previous two and will be discussed in more detail in 
Sec. rvlLTI 



C. Graph states and nullifiers 

1 . Graph states 

A common and convenient way of depicting cluster states 
is by using graphs. The continuous-variable version of graph 
states was defined bv lZhang and BraunsteinI (|2006) where ev- 
ery co ntinuous-variabl e cluster state can be represented by a 
graph dGu et al. I l2009h known as a graph state^. Specifically, 
a graph G = (V, E) consists of a set of vertices (or nodes) 
V and a set of edges E. The following recipe allows us to 
construct a corresponding graph state 

1 . Each squeezed momentum eigenstate becomes a vertex 
in the graph. 

2. Each Cz operation applied between two qumodes is an 
edge in the graph. 

To illustrate, we give a simple example of a two-mode clus- 
ter state. Below we have the first step of initializing the two 
squeezed momentum eigenstates (represented by vertices and 
labeled 1 and 2). In the second step the Cz gate is applied, 
indicated by the edge joining vertices 1 and 2. The final step 
illustrates how measurements are indicated on a graph. Here 
a p quadrature measurement on the first node is implemented 



GXD - (EKD ''''' 



2. Implementing gates using measurements 

We have just shown that by performing a measurement in 
the basis U^pU we can simulate the effect of the U gate on 
an arbitrary state. Using this result with the previously men- 
tioned Lloyd-Braunstein criterion, we are able to implement 



* From now on we will use the terms "cluster states" and "graph states" in- 
terchangeably. Note that some authors technically refer to a cluster state 
as one which has a graph that is universal for measurement-based com- 
putation (e.g., a square lattice); while a graph state cou ld be any arbi- 
trary graph. However, in the continuous-variable l iterature jpiammia et all 
12003 : iMenicuccil . |201 ll iMenicucci etali l2008l l201lL l20ld.l200d) lUs 
common to use them synonymously with context providing clarity. 
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Previously we introduced the quantum circuit formalism to 
understand measurement-based computation. Therefore we 
give below an equivalence between the teleportation circuit 
(on the left) and the graph state formalism (on the right) 



|0), 



— p = mi 



|0)p 
The concept 

been d ev eloped in a number of papers by Z hang (IZhang 



of continuous-variable graph sta tes has 



2008allbl l2oToh and i n depen d ently by others dAohta ef al. 



2009; 



201 ll; 'Flammia et al\ '2009'; Flammia and Severin: 
Menicucci et aU 2008„ 2007; Pfister, 2007; Zaidi et al} 
Zhang et a/.l lioogT Recently, a more general approach was 
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introduced by Menicucci et al\ (1201 ll) allowing the graphical 
calculus formalism to be applied to the practical case where 
continuous-variable cluster states are created using finitely 
squeezed Gaussian states rather than ideal perfectly squeezed 
eigenstates. 



2. Stabilizers and nullifiers 



The stabilizer f ormalism jGottesmanl 1997h fo r con- 
tinuous variables ([Barnesl 120041 : Gottesman et al. I I2OO1I 
Ivan Loock et al. I I2OO7I) is a useful way of both defining and 
analyzing cluster states (or graph states). An operator O is 
a stabilizer of a state if 0|V') = it has an 

eigenvalue of +1. For example, a zero momentum eigen- 
state |0)p is stabilized by the displacement operator X{s), 
i.e., X{s) |0)p = |0)p for all values of s. For an arbitrary 
continuous-variable graph state with graph G = {V,E) 
on n qumodes, the stabilizers are defined as 



jeN{i) 



(171) 



for i ~ I, n and for all s G M. Here N{i) means the set of 
vertices in the neighborhood of Vi, i.e., N{i) = {j\{vj,Vi) £ 
E}. A variation of these stabilizers Ki involves using what is 
known as nullifiers Hi. Here every stabilizer is the exponen- 
tial of a nullifier, i.e., Ki{s) = e"*^^' for all s € R. This 
results in Hi =0 where the set of nullifiers are given by 



q.j. 



(172) 



Therefore the graph state |0) is a zero eigenstate of the above 
nullifiers where any linear superposition satisfies Hi\%lj) =0 
and [Hi, Hj] = 0. An example might be helpful here. Sup- 
pose we have a simple three-node linear cluster where the 
nodes are labeled 1,2 and 3. Then, according to Eq. (|172t , 
the nullifiers are given by: pi — q2,P2 — qi — q3,P3 — q2- Fur- 
thermore, according to Eq. (1171b . the set of stabilizers can 
be written as: Xi{s)Z2{s), Zi{s)X2{s)Z3{s), Z2{s)X3{s), 
for all s. Therefore, by simply looking at a given graph we 
can write down the nullifiers and stabilizers of that particular 



graph. We note another useful way of analyzing graph states, 
other than t he nullifier form alism, is by using the Wigner rep- 
resentation dGu et al I I2OO9I) . 



(nO) 3. Sliaping clusters: removing nodes and shortening wires 



The nullifier formalism provides a useful way of under- 
standing how graph states are transformed by quadrature mea- 
surements. It can be shown (IGu et al. I l2009l) that q (compu- 
tational) measurements remove a given node (modulo some 
known displacement), while p quadrature measurements also 
remove the node but preserve the correlations between neigh- 
boring nodes (modulo a displacement and Fourier transform). 
For example, in the graph state picture, a position quadrature 
measurement on the second node has the following effect 



(IKIKI) 



and a momentum measurement on the second node we have 



(IKIKI) 



GKI) 



Using the above techniques we can shape a Gaussian cluster 
in order to put it into the required topology to perform a spe- 
cific algorithm. For example, below we can create the graph 
state on the right by first performing a sequence of quadrature 
measurements on an initial 4x5 cluster given on the left 




0000 

ocoo 



(173) 

Recently, an experimental demonstration of continuous- 
variable cluster state shaping was performed using a four- 
mode line ar cluster usin g homodyne detection and feedfor- 
ward (.Miwa. et al.lllQldi . 



D. Gaussian errors from finite squeezing 

In the next section, we will look at ways in which Gaus- 
sian cluster states can be implemented optically. As soon as 
we start discussing practical implementations we have to con- 
sider using finitely squeezed Gaussian states in our analysis 
which inevitably introduces errors into our computations. To 
illustrate the effect of finite squeezing we show what happens 
to the propagation of quantum information in a simple telepor- 
tation protocol. We now go back to the teleportation circuits 
from Sec. IVll.B. II where we showed the effect of teleporting. 
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first a qumode and then a gate diagonal in the computational 
basis, from one quantum wire to another In that particular 
scenario, the nodes of the cluster were momentum eigenstates. 
In the calculations that follow they will be replaced by Gaus- 
sian squeezed states, i.e., |0)p — > |0, Vs)^ where Vs < 1 is 
the variance of the input squeezing. Suppose we initially start 
off with the two input states \^) and |0, Vs)^ where both can 
again be expanded in terms of arbitrary position bases, i.e., 
li)) ^ Jdqii:{qi) \qi) and 



\Q,Vs),^{7tVs) 



-1/4 



dq2 e 
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Applying the CPHASE gate to these two states gives 



(175) 

After performing a measurement on the first mode in the mo- 
mentum basis we end up wit h: = MX(mi)F \ 4>), where 
is a Gaussian distortion (iMenicucci et al l l2006t) 

M IV) oc [ dq e«'^^/2 |^^) (^7^) 



So effectively what we have is a Gaussian distortion, with zero 
mean and variance 1 /Vs, applied to the original input state as 
a result of propagating through a cluster created using finite 
squeezing (equivalently, this can be thought of as a convolu- 
tion in momentum space by a Gaussian of variance Vs). The 
same reasoning holds when we consider the gate teleporta- 
tion situation where the output is given by MX{mi)FU \tl') . 
We note that the above distortions due to finite squeezing er- 
rors of both state propagati on and un i versal gate teleportation 
have also been analyzed bv lGu et'al. ](|2009|) from the point of 
view of the Wigner representation. 



E. Optical implementations of Gaussian cluster states 

Here we look at the various methods to optically implement 
continuous-variable cluster states using Gaussian elements. 
The advantage of the continuous-variable optical approach, 
compared to the discrete-variable approach, is that the gen- 
eration of continuous-variable cluster states is completely de- 
terministic. Furthermore, once the cluster is setup only homo- 
dyne detection is nee ded to implement any multimo de Gaus- 
sian transformation dUkai. Yoshikawa. et ail I2OIOI) . How- 
ever, the errors introduced into the computations, due to the 
finitely squeezed resources, are a downside to this uncondi- 
tionality. The five methods for cluster state production are 
outlined below. 



an optical Gaussian cluster state. By that we mean each 
mode is first prepared as a momentum squeezed vacuum 
state and then an appropriate number of Cz gates are 
applied to create the required cluster The Cz gate is 
optically impleme nted using two be a m sp li tters and tw o 
onUne^ squeezers dWalls and Milburnl 120081: lYurkel Il985l) . 
One of the advantages of this method is that the Cz gates 
commute with one another (i.e., the order in which they 
are applied does not matter) and thus facilitates theoretical 
analysis. On the other hand, the im plementatio n of th e Cz 
gate is experimentally challenging dUkaiefg/.l 201 ll) due 
to the difficulty of onhne squeezin g dLa Porta et al. 
lYoshikawa eraIll2007l:lYurkel.ll985l) and therefore is not very 
efficient as Cz gates are needed for every link in the cluster. 
Note that the demonstration of another type of quantum 
non-dem olition (QND) ga t e (the SUM gate) has also been 
achieved dYoshikawa et a/.ll2008l) . 



2. Linear-optics metliod 

The linear-optics m e thod was conceived by van 
Loock dvan Loock et all |2007|) and provided a way of 
greatly simplifying the optical implementation of the canon- 
ical method. Put simply, the linear-optics method allows 
the creation of a cluster state using only offline squeezed 
states and a beam splitter network. Experimentally this 
represented an important advancement in the building of 
continuous-variable cluster states as the difficult part o f 
online squeezi ng was now moved of fline dGu et al. I I2OO9I) . 
In this work dvan Loock et al I I2OO7I) two algorithms were 
developed using squeezed vacuum states and linear optics to 
create two varieties of cluster states: (1) canonical Gaussian 
cluster states and (2) generalized cluster- type states. The first 
algorithm, known as the decompositional algorithm, used the 
Bloch-Messiah reduction (cf. Sec. |II.C.2| i to show that the 
canonical method can be decomposed into offline squeezed 
states and beam splitters to create the original canonical 
cluster The second algorithm (this time independent of 
the Bloch-Messiah reduction) showed how to create a more 
general class of Gaussian cluster states, known as cluster-type 
states (from which the canonical cluster states are a special 
case). This was shown by requiring that the final cluster 
state (again created from squeeze vacuum states and carefully 
configured passive linear optics) satisfies the nuUifier relation 
of Eq. ( 11721 ) in the limit of infinite squeezing. However, when 
the finite squeezing case is also considered a larger family of 
non-canonical cluster states are created. 

One of the benefits of the second algorithm is that the an- 
tisqueezing components are supp ressed thus making it ex- 
perimentally more appealing t Yukawa et all l2008l) . Also 
smaller levels of input squeezing are required to create cluster- 



1 . Canonical method 



The canonical method was first introduced in 



2006 dMenicucci et all l2006t IZhang and Braunsteinl |2006|) 
and proposed a literal interpretation of how to implement 



' An online squeezer (also known as inline squeezer) is the squeezing of an 
arbitrary, possibly unknown, state. An offline squeezer is the squeezing of 
a known state, typically the vacuum. 
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type states compared to using the canonical method to cre- 
ate canonical states with the same kind of correlations. A 
number of experiments using the linear-optics method have 
been demonstrate d from s etting up an initial four- m ode 
Gaussian cluster (ISu et al 1 120071: lYukawa et g/.L l2008l) (in- 
cludin g linear, T-shape and square clusters ( Yukawa et al\. 
l2008b ) to simple continuous-variable one -way qu antum com- 
putations on a four-mod e linear cluster dMiwa. et al.^ i2010t 
lUkai. Iwata. ef a/.ll201lh . 



3. Single-OPO method 



The single - OPO-method jplammia et al.[ l2009t 
iMenicucci etM. l2008l l2007h was developed around the 
same time as the linear-optics method and shows how to cre- 
ate an ultra-compact and scalable, universal A^-mode cluster 
state using only a single optical parametric oscillator'^(OPO). 
Effectively this means that the cluster state can be created in 
just a single step using a top-down approach and requires the 
same amount of resources as the linear-optics method (i.e., 
0{N'^)). However, unlike the linear-optics method it does 
not require an interferometer which can be cumbersome for 
large N thus removing the beam splitter network altogether 
It therefore holds great promise of scalability for universal 
continuous-variable cluster states. 

The initial proposal (IMenicucci et ali l2007h showed that, 
by using an appropriately constructed multi-frequency pump 
beam, the single OPO could generate any continuous-variable 
cluster state with a bipartite graph. Mathematically this re- 
sult relied on showing a connection between continuous- 
variable cluster states and Ha miltonian graphs or H-graphs 
for short dFlammia e t al.. 20Q9t Flammia and Severin l l2009t 
IMenicucci et ail 12008. ,20071: IZaidi et ail l2008l) . These H- 
graphs correspond to those states produced by an OPO. With 
this result we have effectively gone from requiring N single- 
mode squeezers (OPOs) to a single multimode OPO which 
is pump ed by an 0(7V^)-mode beam. Further pro gress 
showed dFlammia et al.[ l2009l IMenicucci et al.[ l2008l) that 
this method can in fact produce a whole family of universal 
continuous-variable cluster states where the encoding scheme 
of the single-OPO involves using the optical frequency comb. 
Here each independent qumode corresponds to a different fre- 
quency in the optical frequency comb (which derives its name 
from the equal spacings between each qumode). The main ad- 
vantage of this method is that the number of pump frequencies 
is not 0{N'^) but in fact constant. Recently, the first experi- 
mental demonstration of cl uster state gen eration in the optical 
frequency was performed (|Pysheiir201 ll) . Here 15 quadripar- 
tite cluster states were created over 60 cavity qumodes, ex- 
hibiting its potential for scalable quantum computation. 



4. Single-QND-gate method 

In the four years since the canonical method, and 
its reliance on Cz gates, all of the previous methods 
have purposely shied away from using this non-demolition 
gate due to its difficulty in being experimentally imple- 
mented dUkai efg/I 1201 ll). However, in a novel ap- 
proach dMenicucci et al. [ l201fll) . the Cz gate once again 
makes an appearance in a compact scheme devised to gen- 
erate arbitrarily large cluster states. In the canonical method, 
O(iV^) low-noise Cz gates are needed to set up the initial 
A^-mode cluster. However, in this new approach, all that is 
required is a single Cz gate. In fact, for universal quantum 
computation, only a single copy of the following key opti- 
cal ingredients are needed: a single-mode vacuum squeezer, a 
Cz gate, a homodyne detector and a photon counter. The ba- 
sic premise of the single-QND-gate method involves building 
the cluster on the go where the cluster is extended and mea- 
sured as needed, according to the particular algorithm to be 
executed. 

The specific design of this method can be understood from 
considering a simple linear cluster. In this case momentum 
squeezed vacuum states are generated at regular intervals and 
repeatedly fed into a single Cz gate. One output of the gate 
is directed towards a detector while the other is fed back into 
the Cz gate. Because in general all qumodes travel the same 
optical path, but importantly at different times, the encoding 
scheme of the qumodes is temporal. This process of creating 
and measuring is repeated over and over during the duration 
of the algorithm and can be extended in much the same way to 
create universal cluster states. One advantage that the single- 
QND-gate method offers over the previous approaches is that 
maintaining the coherence of a large cluster becomes less of 
an issue. This is because we are only concerned with the co- 
herence of a small instance of the cluster at any one time. 



5. Temporal-mode-linear-optics method 



' A simple OPO consists of an optical cavity (e.g., two facing mirrors) with a 
crystal inside. Typically this crystal is nonlinear (e.g., second-order x'^') 
and is pumped by a laser beam which can lead to the down-conversion or 
the up-conversion of the initial frequencies. 



The latest approach was developed by enicucc 1 d201ll) 
and combines the essential features and benefits of the pre- 
vious three methods into one. This method, known as the 
temporal-mode-linear optics method, offers an improvement 
over the single-QND-gate approach in that it uses the tech- 
niques from the linear-optics scheme to move the experi- 
mentally challenging online squeezing, offline. This new 
temporal-mode encoding, where again the input squeezed 
vacuum states are repeatedly sent through the same optical 
hardware but at different times, still maintains the finite co- 
herence and scalability features of the previous model. This 
implementation is achieved by recognizing that the output 
states of the single-OPO metho d are in fact G aussian projected 
entangled pair states ( Ohiiger et ail |2010|) . Gaussian pro- 
jected entangled pair states are pairs of Gaussian two-mode 
squeezed states that are locally projected down to a lower- 
dimensional subspace. For example, in the cluster state for- 
malism, this corresponds to having two two-node graph states 
where a measurement projects the ends of both nodes down 
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to a si ngle node and in do ing so creates a linear three-node 
graph dOhliger et a/.l 2010l). Th e graphical formalism devel- 
oped by Menicucci et al\ (1201 ih is used to describe and for- 
mulate this Gaussian projected entangled pair states construc- 
tion and can be optically implemented using single-mode of- 
fline squeezers and linear optics. 



V can be decomposed into two sq ueeze gates and the cubic 



V can be aecomposea mto two sq ue 
phase gate dGottesman et a/.Ll200ll) . i 



v = s{f)vsHf), 



(181) 



where / f{n) = [7/7' (j^)]^^"^- Once these squeezing cor- 
rections are implemented the cubic phase state can be synthe- 
sized. 



F. Universal quantum computation 

As previously noted, the Lloyd-Braunstein criterion tells 
us that in order to achieve universal quantum computation, 
i.e., the ability to generate an arbitrary Hamiltonian, we 
need the addition of a non-Gaussian element, such as a non- 
Gaussian operation or a non-Gaussian state, to our tool box. 
In continuous-variable cluster state quantum computation the 
cubic phase gate and the cubic phase state, respectively, are 
examples of such elements. The cubic phase gate is defined 
as 



(177) 



where 7 £ M. The action of the cubic phase gate on a zero 
momentum eigenstate |0)p creates what is known as the cubic 
phase state I7) which is an unnormalizable non-Gaussian state 



l7)=^|0). 



20F 



dq e*-"?' \q) 



(178) 



Ultimately the cubic phase state will be used as a resource 
to implement the cubic phase gate onto an arbitrary state in 
the cluster. We begin by first showing how to create such a 
state and then explore two methods of implementing the cubic 
phase gate. 



1 . Creating the cubic phase state 



It was shown by iGottesman et al. \ (l200lh that the cubic 
phase state coul d be created by implementing the following 
quantum circuit dGu et al. 



5(r)|0) 



S{r) |0) 



(179) 



where V' = exp{i'j'{n)q'^) and the strength of the gate 
depends on the probabilistic measurement result: 7'(n) = 
(6\/2n + Therefore the above circuit corresponds to 

a simple two-mode graph state with a displaced photon count- 
ing measurement on the first node 



(180) 



Notice that the output state above is not quite in the form we 
would like, i.e., it is 7' and not 7. To correct this note that 




2. Implementing the cubic phase gate 

Now that we have a way of creating the cubic phase state 
we look at two possible approaches to inducing the action of 
the cubic phase gate onto an arbitrary state using the cubic 
phase state as a resource. The first approach deviates from the 
typical measurement-based scheme by performing Gaussian 
measurements on a non-Gaussian cluster state. The second 
approach revisits the typical setup of a Gaussian cluster but 
requires that the measurement tool box now consists of both 
Gaussian and non-Gaussian measurements. 



a. Non-Gaussian cluster and Gaussian measurements 

In the standard cluster-state model of computation all 
nodes are initialized as zero momentum eigenstates before be- 
coming entangled via the CPHASE gate. However, one way to 
implement the cubic phase gate is to first embed the cubic 
phase state into the original cluster In the regime of finite 
squeezing the initial Gaussian cluster state now becomes non- 
Gaussian. A computation is performed as before using only 
Gaussian (homodyne) measurements. Once the cubic phase 
state 1 7) is part of the initial cluster a variation of gate tele- 
portation can be used to teleport V onto an arbitrary state \<j>) 
of the cluster (where for instance {(p) is the state of a node in 
the cluster at a particular poin t in time). The following circuit 
achieves this dGu ef a/.Ll2009h 



\l) = V\0)p 



p = nil 



(182) 



— P - 



TO2 



modulo known Gaussian corrections dWeedbrookl l2009l) 
(hence the w). In the graph state formalism the above circuit 
is depicted as 




p 




p 



Note that the above graph corresponds to a subgraph of a 
much larger cluster One way to think about what is happen- 
ing is that we have the cubic phase gate V acting on a zero 
momentum eigenstate on the second node and by performing 
momentum quadrature measurements on the first and second 
nodes we are effectively teleporting V onto 1 0) (modulo cor- 
rections) with the resulting state appearing at the third node. 
The beauty of using a non-Gaussian cluster from the begin- 
ning is that once it is created only quadrature measurements 
are needed to perform any algorithm. However, creating such 
an improved resource is experimentally challenging. 
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b. Gaussian cluster and non-Gaussian measurements 

Now the previous approach is tailored to creating the cu- 
bic phase state offline, i.e., as one of the initial resource states 
prior to the entangling gate. However, if we wanted to emulate 
the original cluster state formalism by beginning with a uni- 
versal Gaussian cluster, our set of measurements would need 
to be both Gaussian and non-Gaussian (e.g., photon counting). 
One consequence of this is the need to perform the squeezing 
corrections of Eq. ( II8II 1 online. With this in mind circuit ( 1182b 
now becomes 



S{f) 



|o>. 



p = mi (183) 



p = m2 



where the second squeezing correction is dependent on the 
first measurement result nii b ecause it is itself de pendent on 
the photon counting result n dWeedbrookl l2009h . Translat- 
ing the above circuit into the graph state formalism and using 
graph (1180b gives the following 




Sif) 





where the input state 10) is the first node from the left. 
Here the square boxes represent subgraphs through which 
the squeezing corrections, S{f) and 5*^(7, mi ), are i mple- 
mented via homodyne measurements dvan Loockll2007l) . An- 
other consequence of the non-Gaussian measurement is that 
the concept of parallelism is not longer valid as the center top 
node needs to be measured first due to the probabilistic na- 
ture of the measurement outcome. After which the amount of 
squeezing required on the first node is dependent on the result 
n. Hence the time ordering of measurements now matters and 
adaptiveness plays a role (depending on the specific algorithm 
performed, the value of 7 might also depend on previous mea- 
surement results as well). From the above graph one can no- 
tice that ideally the top center node is only attached to the node 
below it. This is where the shaping tools from Sec. IVII.C.3I 
play a part. For example, if there is a point in the computation 
on the Gaussian cluster where the cubic phase state needs to 
be created then removing or deleting nodes from the cluster 
would allow one to have it in the required form. 



G. Quantum error correction 

To argue that a particular physical system is capable of uni- 
versal quantum computation it is not sufficient to show that 
the system in question can implement arbitrary unitary evolu- 
tions. In any physical implementation there will be imperfec- 
tions in the system that will inevitably lead to random errors 



being introduced. Even if these errors are small, when large 
scale quantum processing is considered, we have to worry 
about their propagation during gate operations. If uncorrected, 
such errors will grow uncontrollably and make the computa- 
tion useless . The answer to this proble m is fault tolerant error 
correction (IShoiill995LlSteaneLll996l) . Thus to make a nec- 
essary and sufficient argument that a particular physical sys- 
tem is capable of continuous-variable quantum computation, 
strictly one must also show that fault tolerant error correction 
is possible. 

The idea of error correction is self-explanatory, though the 
description of its application to quantum systems requires 
some care. Classically we might consider using a redundancy 
code such that, for example, 000 and 1 111. If a 
bit flip occurs on one of the bits we might end up with 010 
or 101 but we can recover the original bit value by taking a 
majority vote. An example of a quantum redundant encoding 
forqubits is a|0) + /3|1) -> a|000) + /3|111) where we have 
created an entangled state rather than copies. It is then possi- 
ble to identify an error without collapsing the superposition, 
by reading out the parity of pairs of qubits. For example a 
bit-flip error might result in the state a|001) + /3|110). The 
parity of the first two qubits will be zero whilst the parity of 
the second two qubits will be one, thus unambiguously iden- 
tifying that an error has occurred on the last qubit. Because 
we are measuring the parity, not the qubit value, the superpo- 
sition is not collapsed. Such codes can be expanded to cope 
with the possibility of more than one error occurring between 
correction attempts and to cope with multiple types of errors. 
Of course the gates being used to detect and correct the errors 
may themselves be faulty. An error correction code is said to 
be fault tolerant if error propagation can be prevented even if 
the components used to do the error correction introduce er- 
rors themselves. Typically this is only possible if the error rate 
per operation is below some level known as the fault tolerant 
threshold. 

The first error correct i on protocol for continu ous vari- 
ables dBraunsteinl Il998al: iLloyd and SlotineL Il998h was de- 
veloped as a direct gen eralization of the qubit redun- 
dancy codes_JSh^_ 19951). In Braunstein's simplified ver- 
sion dBraunsteinl 1998blv ! eight ancilla squeezed states are 
mixed on beam splitters with the signal state to create a 
nine-mode encoded state. Decoding is similarly achieved 
with beam splitters, with homodyne detection on eight of the 
modes providing information about errors on the remaining 
signal mode. T his protocol has r ecently been demonstrated 
experimentally dAoki et al. I I2OO9I) . On any particular run the 
code can correct a ny error that occurs on any sin gle mode of 
the encoded state dWalker and BraunsteinL 120101) . This was 
shown to exten d to multip l e erro rs provided they occur in a 
stochastic way dvan Loockl l2008l) . Unfortunately, error mod- 
els of this kind are non-Gaussian error models and do not cor- 
respond to the Gaussian errors that typically occur in experi- 
ments due to loss and thermal noise. Other protocols for cor- 
recting more specific types of non-Gaussian noise imposed 
on Gaussian s tates have been proposed and experim entally 
demonsti-ated dLassen et ali I2OI0I: iNiset et all l2008l) . It has 
been proven that error correction of Gaussian noise, imposed 
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on G aussian states, usin g only Gaussian operations is impos- 
sible dNiset efg/.l [20091) . 

This no-go theorem does not apply if the initial states are 
non-Ga ussian. An example of such a protocol is that devel- 
oped bv lGottesman et aJ. feooih . Here, the information is dis- 
cretized by encoding qubit states as non-Gaussian continuous- 
variable states. Such states could be gen erated in optical 
modes by means of cross-Kerr interactions dPirandola et ail 
|2004 . Error correction against Gaussian errors can then be 
achieved using Gaussian operations. This protocol is known 
to be fault tol erant, although the thres hold requirements are 
quite extreme (iGlancv and Knilll |2006|) . A simpler encoding 
of qubits i nto continuo us-variable states is the coherent state 
encoding (iRalphefg/.L 12003). Fault tolerant error correction 
against Gaussian errors can also be achieved with t his system, 
with a better threshold behavior dLund ef a/.ll2008l) . The price 
paid for this improvement though, is that non-Gaussian oper- 
ations are also required. 

A third possibility that is not explicitly forbidden by the no- 
go theorem is to error correct Gaussian states against Gaussian 
noise using non-Gaussian operations, that none-the-less result 
in a G aussian output state. Such protocols ha ve been pro- 
posed (iBrowne et al. I I2OO3I) and demonstrated (IXiang et al\. 
I2OIOI) for continuous-variable entanglemen t disti l lation . En- 
tanglement distillation (iBennett. Br assar d, et al\. IS a 
non-deterministic error detection protocol, useful for ex- 
tending the reach of quantum communication systems. 
Continuous-variable protocols have also been developed to 
distill entanglement aga inst non-Gaussian noise dPong et al\. 
l2008l: lHage e7an i2008l) and for non-Gaussian states against 
Gaussian noise dOurioumtsev et al\ . |2()09i). In principle, 
continuous-variable teleportation and continuous-variable dis- 
tillation protocols based on noiseless amplification can be 
combi ned to error c orrect Gaussian states against Gaussian 
noise (iRalphl I20T l]). However, it is not currently known if 
such protocols can be made fault tolerant. 

Error correction cannot be directly introduced into the 
continuous-variable cluster state model by simply simulat- 
ing a circuit model error cor r ection protocol with the clus- 
ter (ICable and Brownel l2010t lOhliger ef ad l2010h. This is 
a generalization of the result of Nielsen and DawsonI d2005l) 
that similarly restricts error correction for discrete-variable 
cluster states. These authors showed that error correction 
could only be incorporated into the cluster state computation 
model provided the construction and measurement of the clus- 
ter occurred concurrently, and the off-line, non-deterministic 
production of special states was allowed. In continuous- 
variable cluster state computation, without fully-fletched 
continuous-variable fault tolerance, continuous-variable clus- 
ter states based on any finite squeezing are strictly speak- 
ing not resources for continuou s -variab le cluster state quan- 
tum computmg dOhhger et ali I2OIOI) . However, it has 
be en argued that in p r incipl e, combining the techniques 
of iNielsen and Dawson ( 2b05b wit h the oscillator encoding 
scheme of Gottesman et al. F oooil) would allow fault toler- 
ant continuous-varia ble cluster state computation to be carried 
out (IGu et al\. l2009l) . though this has not been shown explic- 
itly. 



H. Continuous-variable algorithms 

Finally, before discussing future directions, we briefly 
mention two algorithms that have been developed for a 
continuous-variable quantum computer: Grover's search 
algorithm (Groveri Il997[) and t he Deutsch-Jozsa al- 
gorithm dOeutsch and Jozsai Il992l) . These algorithms 
were originally develop ed for discrete-variable sys- 
tems dNielsen and Chuana, l2000b and later analogs were 
found for continuous-variable systems in terms of the quan- 
tum circuit model formalism. Grover's search algorithrn 
using continuous variables was presented bv lPati et al\ d2000l) 
and showed that a square-root speed-up in searching an 
unsorted database could be achieved in analogy with the qubit 
case. A continuous-variable version of one of the earliest 
quantum algor ithms, the Deutsch- J ozsa a lgorithm, was first 
developed by iPati and BraunsteinI d2003b . Here the goal 
of determining whether a function is constant or balanced 
was constructed in the ideal case of perfectly squeezed 
qu modes. Later, t his alg orithm was analyzed in more detail 
by lAdcock et al. (l2009l) an d reformulated using Gaussian 
states by Zwierz et al\ ( 2OI0t) . 



I. Future directions 

Research interest in the field of continuous-variable quan- 
tum computation has increased significantly in the last few 
years. This is particularly true in the case of cluster state 
quantum computation. Therefore it is worth making a brief 
comparison between the continuous-variable cluster states 
discussed here and the discrete-variable approa ch based on 
single-photon qubits and linear optics techniques (iKnill et g/.l 
2001; Nielsen, 2004). The key trade-off is between construc- 
tion of the cluster and its measurements. In the continuous- 
variable approach construction is deterministic, whilst in the 
single-photon approach it is non-deterministic and requires a 
very large overhead in terms of photon sources and memory 
in order to make it near deterministic. On the other hand, 
all required measurements are trivial in the single-photon ap- 
proach, whilst non-Gaussian measurements pose a major chal- 
lenge in the continuous-variable approach. At this point it is 
difficult to say which of these problems represents the biggest 
impediment to building a large scale system. 

There are a number of important avenues for future re- 
search in continuous-variable quantum computation. Per- 
haps the most important at this stage is the development 
of continuous-variable fault tolerance for cluster state quan- 
tum computation. Another avenue would be to incorporate 
continuous-variable quantum algorithms, such as Grover's al- 
gorithm and the Deutsch-Jozsa algorithm, into the cluster state 
model. Additionally, the development of further algorithms 
for a continuous-variable quantum c omputer, e.g ., an optical 
version of Shor's factoring algorithm dShoii[T997l) . would also 
be interesting, especially for future experimental demonstra- 
tions. 
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VIII. CONCLUSION AND PERSPECTIVES 

This review examined the power of continuous-variable 
quantum information from a Gaussian perspective. The pro- 
cessing of Gaussian quantum information involves the use of 
any combination of Gaussian states, Gaussian operations, and 
Gaussian measurements. The ability to characterize Gaus- 
sian states and operations via their first and second-order sta- 
tistical moments offers a major simplification in the mathe- 
matical analysis of quantum information protocols. Over the 
last decade, optical and atomic Gaussian states and operations 
have being recognized as key resources for quantum informa- 
tion processing. For example, continuous-variable quantum 
teleportation only requires Gaussian entanglement and Gaus- 
sian operations, while it can be used to teleport arbitrary, even 
highly non-Gaussian, quantum states. Similarly, continuous- 
variable quantum key distribution works with coherent states, 
while it achieves the unconditional security once believed to 
reside only with highly non-classical resources. Yet another 
unexpected property is that a Gaussian cluster state is prov- 
ably a universal resource for quantum computation. All of 
these findings have put forward the idea that Gaussian pro- 
tocols deserve a front row position in quantum information 
science. 

Beyond a comprehensive description of Gaussian quantum 
information protocols, this review also examined bounds on 
the distinguishability of Gaussian states, and features of Gaus- 
sian bosonic quantum communication channels such as their 
capacity and statistical discrimination. Future directions in 
quantum information sciences include the exploration of more 
complex scenarios of quantum communication, involving dif- 
ferent protocols such as quantum cloning or teleportation net- 
works. In this context, the Gaussian approach is particu- 
larly promising, allowing us to explore these future directions 
with powerful mathematical tools and standard optical com- 
ponents. 

From a purely Gaussian perspective, i.e., when one is re- 
stricted to using states, operations and measurements that 
are all Gaussian, certain protocols are not possible. For ex- 
ample, universal quantum computation, entanglement distil- 
lation, and error correction all require that the protocol be 
supplemented with either a non-Gaussian state, operation, or 
measurement. For some tasks, hybrid systems, which com- 
bine elements from continuous and discrete-variable quantum 
information processing, are then favored as they may outper- 
form purely discrete- variable systems. Interestingly, the pow- 
erful mathematical tools of Gaussian analysis can sometimes 
be used even when non-Gaussian processing or non-Gaussian 
states are involved. For example, in certain quantum key dis- 
tribution protocols, even if Alice and Bob use non-Gaussian 
distributions or Eve makes a non-Gaussian attack, the security 
can be ensured by considering the worst case of a Gaussian at- 
tack against a Gaussian protocol. Such an analysis would still 
hold if quantum repeaters based on non-Gaussian processing 
were used by Alice and Bob. Similarly, universal quantum 
computation achieved by a Gaussian cluster state and non- 
Gaussian detection is an example of the power brought by the 
application of Gaussian analysis tools to hybrid quantum sys- 



tems. 

In conclusion, we anticipate that Gaussian quantum infor- 
mation will play a key role in future developments of quantum 
information sciences, both theoretical and experimental. This 
is due to the simplicity and versatihty of the involved proto- 
cols as well as the availability of the required technologies. 
We hope that this review will help encourage these develop- 
ments. 
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